Fajar Priyanto wrote: > I've been checking our network traffic using iptraf, and it seems that a > client is consuming high bandwidth. Unfortunately, iptraf only shows the mac > address. > Can I get the ip address from the mac address? > I don't use dhcp so I cannot use dhcpreport.pl --mac. > > Thanks. How about the arp cache? # arp If you talked to the bad machine recently, it'll be in your arp cache and listed with IP and MAC. To force lots of machines in your arp cache, I think this kind of ping broadcast might help (adjust the broadcast address accordingly). # ping -b 192.168.0.255 A whole other way is to tcpdump based on the traffic port, for example tcpdump port 1234 -Andy
