how would i filter a capture to find what nodes have the wrong subnet mask? i.e my network is 10.128.5.x / 255.255.255.0 but a client is misconfigured using 255.255.0.0 asked 08 Nov '12, 12:16  pcmonkey |
3 Answers:
You can find wrong subnetmasks either by finding for ARP requests that are looking for MAC addresses of IP addresses they should not be able to reach directly (which is your case), or by finding ICMP redirect messages from default gateways that tell clients to talk to the target node directly (if the mask is too narrow). answered 08 Nov '12, 12:18  Jasper ♦♦ edited 08 Nov '12, 12:19 |
Are you for something like arp and not arp.dst.proto_ipv4 == 10.128.5.0/24 ? answered 08 Nov '12, 12:32  packethunter I will try that packethunter (08 Nov '12, 13:48) pcmonkey |
In addition to what @Jasper said, look for broadcast packets to 10.128.255.255. If it's a Windows machine it will eventually send some broadcasts to it's network broadcast address. Filter: ip.address eq 10.128.255.255 Regards answered 08 Nov '12, 19:02  Kurt Knochner ♦ |
So i make a filter for icmp.redir_gw ??
you could filter for icmp.type==5, because type 5 is a redirect message. And if you combine that with an IP filter on your default gateway you should be able to spot these things.