[TriLUG] finding a MAC address

[jonc at nc.rr.com]

Most VoIP phones check in via TFTP and ask for their update or configuration files using their own MAC as the identifier, like a login name. 

A device could easily ask for a random file name... and be rejected. So if it is a phone or device that has gone wonky it could very well be asking for the wrong file name (wrong MAC address)... in which case, the voip provider wouldn't really know the MAC address of the offending device - still the requested name would show up in a packet sniff as it passed out the firewall. 

Jon Carnes

---- Shawn Taylor <shtaylor at gpi.com> wrote: 
> 1>
> 
> The phones are given an IP address in their configuration that is used to
> pull down the boot image. This is configured in each phone manually or via
> DHCP. It's not a broadcast that should be happening, it's a tftp connection
> to a host.
> (at the voip provider)
> 
> 2>
> 
> Broadcasts are specific to a "Broadcast Domain" (VLAN or HUB). So you
> wouldn't see that on the other side of a layer three device.
> 
> 3>
> 
> The phone MAC address (and the phone system MAC address) should be contained
> in the Ethernet header of the packet. This is what you would need to look at
> if the packet was going out to the internet layer3. However if the packet is
> going out via layer 2, then the mac information will be in the arp table of
> the internet router.
> 
> Shawn
> 
> 
> Scott Wrote:
> 
> They shouldn't go out.  So how is a MAC address being seen on another
> network?   Does your VOIP company have a device on your network?
> 
> 
> -- 
> TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
> TriLUG FAQ  : http://www.trilug.org/wiki/Frequently_Asked_Questions