nv-l
[Top] [All Lists]

Re: [nv-l] The -J netmon option. IP spoofing?

To: nv-l@lists.us.ibm.com
Subject: Re: [nv-l] The -J netmon option. IP spoofing?
From: igastelu@unm.edu
Date: Thu, 22 Jan 2004 04:03:00 -0700
Delivery-date: Thu, 22 Jan 2004 11:33:15 +0000
Envelope-to: nv-l-archive@lists.skills-1st.co.uk
In-reply-to: <1074240915.40079d93246eb@webmail1.unm.edu>
References: <1074240915.40079d93246eb@webmail1.unm.edu>
Reply-to: nv-l@lists.us.ibm.com
Sender: owner-nv-l@lists.us.ibm.com
Hi, I am reposting the qwestion hoping that somebody can help me.

In brief I would like to know how is that netmon uses the -J option to 
generate a broadcast in the remote networks?  Is it a directed 
broadcast to the subnet brodcast address?

Thanks


Quoting igastelu@unm.edu:

> Hi, I would like to know how the -J option causes the broadcast in
> the 
> local network.  From the manual(NV for NT):
> -J Causes netmon to attempt to speed the process of discovering new 
> nodes at the expense of limited broadcast traffic. When a new network
> 
> or subnet is first discovered, netmon causes the first sufficiently 
> capable node it discovers in that network or subnet to broadcast an 
> ICMP Echo request. Thereafter, while the network or subnet remains in
> 
> the map, netmon causes no additional broadcasts to be generated
> there.
> 
> However, most of us does not respond to ICMP echos to our subnets 
> broadcast addresses('no ip-directed broadcast' on Cisco). I suspect
> the 
> reason to create a broadcast once an SNMP capable host is discovered
> is 
> to retrieve a fresh ARP table with all the actives host on it, but I
> 
> can not see how it is done.  Is it a spoofed IP datagram with the 
> source IP address changed to the IP of the remote SNMP capable host?
> I hope the question is not out of order.
> Thanks for your help
> 
> Inaki
> 

<Prev in Thread] Current Thread [Next in Thread>

Archive operated by Skills 1st Ltd

See also: The NetView Web