On Nov 2, 10:13, Arno Kletzander wrote: enough Which is correct for a Class A network... Is "pa3" the printer name? What that means is that the Sun's Ethernet software "knows" that "pa3" means IP address 111.1.0.1, but nothing has responded to any attempt to communicate with that IP address, so it doesn't know its hardware address. On an Ethernet, as you probably know, the data packet is wrapped in several layers of what you might think of as envelopes. The outermost one contains the MAC addresses of sender and intended recipient, and is what is always used for the delivery of the packet to the next (which may be the final) destination en route. So for "hombre" to know how to send a packet to "pa3", it first looks up pa3's IP address (in etc/hosts, or using DNS), and then broadcasts an ARP (Address Resolution Protocol) packet (sender: hombre's MAC address; destination: Ethernet broadcast address, FF:FF:FF:FF:FF:FF) containing that IP address as data. Whoever owns that IP address is supposed to respond with an ARP reply (same packet type, different flags inside, with sender: pa3's MAC address; destination: hombre's MAC address). Thus hombre learns pa3's MAC address, which it stores in it's ARP table, and uses to send a packet (the one it originally wanted to send) to pa3's MAC address. type Without knowing what was in the packet headers, I can't say what they were. But probably the ARP packets were hombre repeatedly broadcasting an ARP request to get pa3's MAC address. snoop is only available as a binary, from Sun themselves (or from SGI, for the IRIX version). tcpdump and other similar programs are available as freeware with source. tcpdump needs a library called libpcap, whicxh is also used by other decoders/analysers, such as Ethereal. transceiver, first 25 "READY"). Probably ARP requests. FF.FF.FF.FF.FF.FF is the broadcast address (destination, in this case). The next layer in the packet would tell you what IP address it was ARPing for. BTW, Ethernet addresses are normally represented with colons (':') separating the octets, not spaces or periods. if switching Yes, they won't mean much in that form. The format of an ARP packet is: hardware type code (2 octets), protocol type code (2 octets), hex 06 (the hardware address length, assuming Ethernet), hex 04 (the IP address length, assuming Ethernet), opcode flags (16 bits giving the type of request/reply) source MAC (6 octets), source IP (4 octets, all zeros if this is a reverse-ARP), destination MAC (6 octets), destination IP (4 octets, may be FFFFFFFF for a broadcast). hombre's IP address appears because it's the sender address of the packets; the name appearing in the second packet suggests it might be a NIS packet of some sort. There's an old version of LANdecoder that runs under DOS, I think. It's not free, though, and I've no idea where to get a copy. sometimes Some of the HP deskjets with JetDirect cards can only be setup/accessed by telnet or RARP/BOOTP/DHCP. You are your own sysadmin :-) That's the address you need for /etc/ethers on a RARP server (or /etc/bootp.conf on a BOOTP or DHCP server for clients that talk something more sophisticated than just RARP). Leave it this way unless you need Novell -- it's very broadcasty and wasteful of bandwidth (a few machines won't be a bother, but a hundred on a segment could) Leave this off too unless you need it. LPD refers to the use of the Berkeley 'lpr' line printer protocol, commonly used by UNIX systems. This is the one your Suns want. haven't Some more experimentation is needed to be sure what all the symptoms really mean. However, obviously the printer isn't responding to an ARP request for what should be its own IP address. Therefore either it is using some other IP address, or it has lost it's configuration and needs to be supplied an IP address (by RARP or otherwise), or the interface is broken/dormant. I expect that this printer, which is quite old, can only use RARP (which is an old and simple protocol, but still in use), not BOOTP or DHCP, to get an IP address. If it were actually trying to do so, you ought to see some ARP packets emanating from the printer, with the printer's MAC address as the source, and the Ethernet broadcast address as the destination. Since you're not seeing that, I assume the card is either completely faulty (no link light etc?) or is so badly misconfigured (possibly the setup has been corrupted by age, or suffers from flat battery if there is one) that it needs reset to factory defaults before it will operate. -- Pete Peter Turnbull Network Manager University of York