dhcpdecline messages

[Simon Hobson]

Andy Hood wrote:

>  > I think you will find that after attempting to ping the address in
>>  question, if you then query the arp table ('arp -a' on most unix like
>>  systems) you will find that there is in fact a mac address listed for
>>  it.

>Which only works if you are on the same segment as the target. If you are
>not on that segment, the best place to look is in the arp cache on the
>router/switch to which that segment is connected.

Indeed - arp is local to the subnet, or more correctly local to the 
broadcast domain, where the device is located. Although you don't 
NEED access to the router as long as you have remote access to a 
system on the remote subnet where you can inspect the arp cache - 
manageable switches are very useful for this, particularly the better 
ones where you can search by mac address and see which port it is 
connected to. Coupled with an up to date patching and cabling 
database, you can narrow down 'the culprit' to a specific socket in a 
specific room - that can [ impress | spook ] a user no end ;-)