[ILUG] tcpdump .. and friends

[Kenn Humborg]

> Hi,
> I need some help finding a windows (98/me/xp) box which is 
> sending port 30001 
> stuff.
> My ipchians firewall is rejecting udp from  132.25.4.169:30001 to 
> 255.255.255.255:30001
> 
> tcpdump shows these packets on my eth0 (lan int) every 20 seconds.
> but only gives the 132.5.24.169 address...
> 
> My local lan is all 192.168.0.xxx
> How can I find which box is sending the packet ?

   # tcpdump -e -i eth0 port 30001

This will show you the ethernet address.

   # for i in `seq 1 254` ; do ping -c 1 192.168.0.$i ; done
   # arp -a

This pings each local machine which will create ARP cache entries
for them.  Then look for your target ethernet address in the arp -a
output.

Later,
Kenn