Subject: [netatalk-admins] how to identify a machine by its number?

From: patrick finerty <[email-masked]>
Date: Sun, 7 Dec 1997 17:57:34 -0700

hi,

 i posted this once and received no replies. there must be a way to
 associate the number with a machine name. how do i do it?

-----------------
 someone i don't know has been repeatedly trying to access my machine
 via netatalk. i don't appreciate this sort of behavior since i've
 found it usually doesn't stop by itself.
 
 how i can figure out what zone and the mac they are using?
 
 here's what i see in my log file:
 
 Dec  4 16:09:06 zifi afpd[570]: session from 20092.227:243 on 58624.155:129
 Dec  4 16:09:06 zifi afpd[570]: login noauth
 Dec  4 16:09:15 zifi afpd[570]: done
 Dec  4 16:09:15 zifi afpd[100]: server_child[0] 570 done
 
 thanks,
 
 -patrick finerty

---

From: Julian Elischer <[email-masked]>
Date: Sun, 7 Dec 1997 17:15:52 -0800 (PST)

On FreeBSD you could just do:

netstat -f atalk

and it would show all the appletalk sessions open
if you are on a system less seamlessly integrated (that's about all of
them) then there is often a special utilty that is similar.

>  associate the number with a machine name. how do i do it?
well, there it is..
20092.227

try:
 nbplkup |grep 20092.227
then use hammer on machine owner

---

From: patrick finerty <[email-masked]>
Date: Sun, 7 Dec 1997 18:21:52 -0700

hi,

i've checked the man pages inside and out. nbplkup won't even tell me
the name of a computer next to me when i use a number to specify it.
i'm sure my syntax is wrong but i can't figure out the correct syntax.

for instance:

zinc-> nbplkup "  b's X"

                          b's X:AFPServer                          58624.87:250
                          b's X:PPCToolBox                         58624.87:251
                          b's X:Macintosh II                       58624.87:253
                          b's X:Workstation                        58624.87:4

but this gives no response (putting it in quotes doesn't help):

zinc-> nbplkup 58624.87:250

what am i doing wrong?

 > nbplkup should be able to tell you who 20092.227:243 is.
 > 
 > check the man page for it.
 > 
 > --Paul L.
 > 
-- 
       "There is only one aim in life and that is to live it."
 Karl Shapiro,(1959) from an essay on Henry Miller's Tropic of Cancer
	  finger [email-masked] for PGP key
		    http://zifi.genetics.utah.edu

---

From: patrick finerty <[email-masked]>
Date: Sun, 7 Dec 1997 20:20:31 -0700

even though the exact address is not constant, it appears that at
least the first number is associated with the zone of the machine (all 
of the machines in my zone start with the same number). 

On December 7, 1997, Ashok Aiyar wrote:

 > There is no "fail-safe" method of identifying the machine.  You
 > can use nbplkup, and if the offending machine is still online,
 > *and* has the same ethertalk-id, you will have achieved your goal.
 > 
 > Ethertalk-IDs are not constant from session to session, it is possible
 > you will identify the wrong machine.

---

From: John Ostrowick <[email-masked]>
Date: Mon, 8 Dec 1997 07:42:40 +0200 (SAT)

go to the mac itself and option click the mactcp ethernet icon in the
control panel to get the ethernet address.

________________________________________________________________
John Ostrowick                 [email-masked]
Computer Science Department,   University of the Witwatersrand
1 Jan Smuts Ave, Johannesburg, South Africa. Senate House 1012
Phone: +27 11 716-3783         Fax: +27 11 339-3513
My web page: http://macaroni.cs.wits.ac.za/more/jon/aboutme.html
My ftp site: ftp://macaroni.cs.wits.ac.za
My listserv: http://macaroni.cs.wits.ac.za/listservs.html

---

From: Mark Donnelly <[email-masked]>
Date: Mon, 08 Dec 1997 11:20:21 -0600

>zinc-> nbplkup 58624.87:250

why don't you try:

zinc-> nbplkup | grep 58624.87:250

--Mark
   "I think so Brain, but if they called them sad meals, then 
    no one would buy them."

---

From: Mark Donnelly <[email-masked]>
Date: Mon, 08 Dec 1997 11:38:58 -0600

On Mon, 08 Dec 1997 11:20:21 -0600 [email-masked] (Mark Donnelly)

>zinc-> nbplkup | grep 58624.87:250
oops, that should be 

zinc-> nbplkup | grep 58624.87

Also, I'll re-iterate the warning given before.  The network numbers of
Macintoshes are subject to change.  As I've heard, on startup, it tries
a (cached) number to see if it's in use, then uses it if it isn't, or
tries another number if it is, and so on...

So, if people haven't been adding more machines to your network, this
will likely give you the right result, but possibly not.  I'd suggest
asking before you take somebody else's suggestion and paddle the
offender.

Good Luck!
--Mark

---

From: Bill Studenmund <[email-masked]>
Date: Mon, 8 Dec 1997 12:46:39 -0800 (PST)

> i'm sure my syntax is wrong but i can't figure out the correct syntax.

Of course not. nbplkup sends out a message in terms of the text strings,
namely the name, type, and zone of an entity. Network number is not one of
the querry parameters.

What you really need is to either do a general nbplkup and grep for the
answer, or look at the aarp tables (I'm not sure of a utility to do this,
but the latter'd give you a hard ethernet address for the offender).

Good luck!

Take care,

Bill