Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a few IP spoof dropped messages coming out of my Sonicwall firewall, we'll call them Source A and Source B. Both of these sources have the same mac address indicating they're coming from the layer 3 switch behind my firewall. Source A has an ip within a valid subnet on my network and it shows up in the ARP table of my layer 3 switch. I was able to trace the exact location and fix the issue. Source B's ip however, is not within valid subnet on my network and it's not showing up in my layer 3 switches arp table. Any idea how I can trace the location of this device within my network?

Thanks in advance.

share|improve this question

Run "show mac address-table" on your switches (inside and outside the firewall), this will give you a list of the mac addresses and the physical ports they are connected to. Once you have the physical port, you known the computer that is spoofing.

share|improve this answer
I don't know the mac address of the device in question so that will not work. I only have the mac address of the previous hop which is the layer 3 switch. – Jared Nov 23 '12 at 21:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.