arp caches, of course, because ip packets are only exchanged intermittently.
Whether it caches long enough for you is a different question. Thanks, -- Raul On Fri, Jun 23, 2017 at 1:03 AM, Indunil Jayasooriya <induni...@gmail.com> wrote: > > arp -a gives all. > > thanks a LOT. > > it gives current list. > > > Is there any way to get an MAC address of a PC that was connected to OpenBSD > PF box but now it is NOT connect to. > > This PC was removed from the network recently for auditing purpose. > > Can arp give old stuffs? Does it have a caching database somewhere in > OpenBSD or do you know any other software that can fulfill my need. > > Sir, Hope to hear from you. > > > > > On Fri, Jun 23, 2017 at 9:55 AM, Raul Miller <rauldmil...@gmail.com> wrote: >> >> http://man.openbsd.org/arp.8? >> >> -- >> Raul >> >> >> On Fri, Jun 23, 2017 at 12:01 AM, Indunil Jayasooriya >> <induni...@gmail.com> wrote: >> > Hi Misc, >> > >> > >> > I do want to get an MAC address of a LAN PC that is 192.168.1.x >> > >> > This PC is behind OpenBSD pf box. >> > >> > this below command only shows IPs. >> > >> > tcpdump -n -e -ttt -r /var/log/pflog >> > >> > >> > How can I get it from this OpenBSD Pf box? >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > -- >> > cat /etc/motd >> > >> > Thank you >> > Indunil Jayasooriya >> > http://www.theravadanet.net/ > > > > > -- > cat /etc/motd > > Thank you > Indunil Jayasooriya > http://www.theravadanet.net/ >
