[TriLUG] finding a MAC address
jonc at nc.rr.com
jonc at nc.rr.com
Fri Aug 15 20:07:14 EDT 2008
Most VoIP phones check in via TFTP and ask for their update or configuration files using their own MAC as the identifier, like a login name.
A device could easily ask for a random file name... and be rejected. So if it is a phone or device that has gone wonky it could very well be asking for the wrong file name (wrong MAC address)... in which case, the voip provider wouldn't really know the MAC address of the offending device - still the requested name would show up in a packet sniff as it passed out the firewall.
---- Shawn Taylor <shtaylor at gpi.com> wrote:
> The phones are given an IP address in their configuration that is used to
> pull down the boot image. This is configured in each phone manually or via
> DHCP. It's not a broadcast that should be happening, it's a tftp connection
> to a host.
> (at the voip provider)
> Broadcasts are specific to a "Broadcast Domain" (VLAN or HUB). So you
> wouldn't see that on the other side of a layer three device.
> The phone MAC address (and the phone system MAC address) should be contained
> in the Ethernet header of the packet. This is what you would need to look at
> if the packet was going out to the internet layer3. However if the packet is
> going out via layer 2, then the mac information will be in the arp table of
> the internet router.
> Scott Wrote:
> They shouldn't go out. So how is a MAC address being seen on another
> network? Does your VOIP company have a device on your network?
> TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug
> TriLUG FAQ : http://www.trilug.org/wiki/Frequently_Asked_Questions
More information about the TriLUG