nv-l

Re: [nv-l] The -J netmon option. IP spoofing?

2004-01-22 06:33:14
Subject: Re: [nv-l] The -J netmon option. IP spoofing?
From: igastelu AT unm DOT edu
To: nv-l AT lists.us.ibm DOT com
Date: Thu, 22 Jan 2004 04:03:00 -0700
Hi, I am reposting the qwestion hoping that somebody can help me.

In brief I would like to know how is that netmon uses the -J option to 
generate a broadcast in the remote networks?  Is it a directed 
broadcast to the subnet brodcast address?

Thanks


Quoting igastelu AT unm DOT edu:

> Hi, I would like to know how the -J option causes the broadcast in
> the 
> local network.  From the manual(NV for NT):
> -J Causes netmon to attempt to speed the process of discovering new 
> nodes at the expense of limited broadcast traffic. When a new network
> 
> or subnet is first discovered, netmon causes the first sufficiently 
> capable node it discovers in that network or subnet to broadcast an 
> ICMP Echo request. Thereafter, while the network or subnet remains in
> 
> the map, netmon causes no additional broadcasts to be generated
> there.
> 
> However, most of us does not respond to ICMP echos to our subnets 
> broadcast addresses('no ip-directed broadcast' on Cisco). I suspect
> the 
> reason to create a broadcast once an SNMP capable host is discovered
> is 
> to retrieve a fresh ARP table with all the actives host on it, but I
> 
> can not see how it is done.  Is it a spoofed IP datagram with the 
> source IP address changed to the IP of the remote SNMP capable host?
> I hope the question is not out of order.
> Thanks for your help
> 
> Inaki
> 

<Prev in Thread] Current Thread [Next in Thread>