Re: Logging source mac address

[Aleksandar Milivojevic <amilivojevic@pbl.ca>]

Eric Leblond wrote:
> To log source address you need to able to know it. This is not the case
> if you are not directly connected to computer that drop via ethernet.
> Thus this is the case for almost all internet IPs....

Logging the MAC address of the router can also be usefull.  For example, 
if there are two routers on the network (each connected to different 
ISP), it would show from which router packets are arriving (usefull for 
debugging).  It could also show if a station on the local network is 
trying to inject packets into an existing connection (OK, this is really 
a task for IDS tool, but anyhow).

With that in mind, I'd say that logging MAC address for all packtes has 
a value (as long as user is aware of couple of basic principles of 
networking).

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7