mcmahill@mtl.mit.edu wrote:
> Is there some sort of mac address query,
> ie, can I do
> 
> magic_command 00:40:05:59:8f:dd
> 
> and see if someone on the cable modem side tried to use 10.0.0.1
> and if so who they really are?

Yes, look into the arp(8) command.  You will to use either
'/usr/sbin/arp -a' or '/usr/sbin/arp -na'.  The form with -n will not
attempt to resolve ip addresses to machine names, the -a only form
will.  You won't enter the MAC address, but you can look up the MAC
address in the output of arp(8). 

Unfortunately, you're still not going to be any closer to finding the
person other than being able to tell what brand network card they are
using!  Furthermore, this will only work for machines that either you
have made a connection to, or have made connections to you.  

The fact that you are on a cable modem also begs me to ask, what are you
doing using a reserved class A address and not a real Internet address?

--
Christofer C. Bell                      Information Systems Lead
Union Computing Services                email: cbell@ukans.edu
University of Kansas                    phone: 785-864-4893