http://www.cert.org/incident_notes/IN-98-05.html: "... Another approach to determine the true origin of spoofed probes is to install network monitoring software which can capture the packets actually traversing the network. Some network monitoring software logs may include the hardware (ethernet) address of the true origin of the probes... " Кто-нибудь может дать пример такого Some network monitoring software для определения MAC-адреса хоста вне локальной сети?