Cisco and ARP troubles

[jay]

On Thu, 12 Apr 2001, Warren Togami wrote:

> This worries me.  MAC to MAC should always work, but I forced a MAC match
> and it still didn't work.  But then again, I've never dealt with Cisco
> hardware before.

is the switch behind the pix a cisco?  you might have port security
turned on and if whoever configured it was trapping for mac address
changes, you may have triggered a shutdown of that port when you
initially switched firewalls.  er, i think the command is something
like "sh port <port>".

if that's not it and you need to sniff the traffic between the router
and the switch, try downloading arpspoof which is part of the dsniff
package by dug song (monkey.org/~dugsong/dsniff).  it'll let you
sniff over a switched segment by poisoning the arp cache of the
target machine.

=jay