> If one answers to ARPs and
> the other doesn't, no one else on the network will ever pick up the MAC
> address of the machine that doesn't respond to ARPs, so even though it is
> configured with a duplicate IP, it doesn't have any effect. Someone
correct
> me if I am wrong here.
I think you're wrong here. (:-) If the quiet machine communicates with any
other, (call it "X".) Then it will update X's ARP chache with the MAC
address of the quiet machine. Any comms going from X to the duplicated IP
address will now go to the quiet machine, until the ARP cache times out, and
then it will go to the other. Yeuch.
On the original subject. It is not just ARP packets that have the MAC and
the IP address in. Every IP packet can be scanned for unique address pairs.
It sounds like a job for tethereal and perl, to me.
--
Richard Urwin, Software Design Engineer
Ricardo Test Automation
Open House, 3 Watling Drv., Hinckley, UK.
rurwin@xxxxxxxxxxxxxxx
