Workshop

I’ve been at sites where the MAC addresses weren’t terribly well documented, so any MAC-related error
was difficult to run down. For example, suppose Windows exclaims that there’s a duplicate TCP/IP
address on MAC address 00:00:C9:05:89:62. It doesn’t do a troubleshooter a lot of good if the
MAC addresses aren’t documented, and if your analyzer doesn’t automatically identify network names
for you, you might think you’re out of luck. Same goes for when your expert analyzer tells you that
00:08:02:55:29:2A is probably a bad network card and is causing many network errors.
Hey, no problem—you’ve got a wiretap! You can listen in to all the MAC traffic generated by this
workstation, and it’s likely that you’ll get something that will identify the user. By taking a look at the
data in the hexadecimal or character-oriented decode window, you can see various data that might lead
you to identify the workstation’s user (or department).
This is something that takes a little practice, but use your head and you’ll get good at it in no time. For
example, filtering on Telnet sessions will give you the entirety of a user’s Telnet. Go to the beginning,
and you’ll get the login name. Check the middle data out, and you might see a report or a menu screen
that only a particular user or department uses. This is a good opportunity to get good at reading your
protocol decodes. If you have the time on a noncritical problem, you should go for it!
If you’re filtering on TCP sessions, look for a SYN packet. This is the beginning of a TCP session—the
equivalent of saying “hello?” when you first pick up the telephone—and it likely has the username in a
nearby packet.
Previous Table of Contents Next