Thank you for your reply. So you mean it is independent of my centos > server ip address range or it just shows the ip addresses in the range > of my centos self ip address? (as I don't have a priori information > about that remote node unknown ip address) > As much as I'm reluctant to respond given past history on this mailing list I'll give the benefit of the doubt ... Firstly the only way you are going to see this (assuming a switched network which seems sane these days) is if that node is eliciting information form other systems - depending on what it is doing this may or may not be true... but if not true you'll never see it ... Now I know english is not your native language but it's important we agree on some terms else we'll be talking past each other with nothing to gain... as such for the purposes of this I'm going to assume you mean 'independent of my centos server ip range' to mean in a different subnet (ie 192.168.1.0/24 when your system is in 192.168.0.0/24) but connected to the same physical network local broadcast area... In order to look for this traffic with tcpdump it'll be best to filter out your local network to reduce the noise: tcpdump not net 192.168.0.0/24 This assumes that your server is in that network ... amend appropriately for your situation... Now if that system is attempting any sort of communication itself you are likely to see ARP requests like: 10:14:13.976075 ARP, Request who-has 192.168.1.254 tell 192.168.1.10, length 42 Reading the above you can see the gateway for that network (192.168.1.254) being requested by the host 192.168.1.10 ... and if this was the case we'd have found our mystery host ... Now if you need to give the host a 'push' into communicating (in case it's otherwise quiet) you can try doing a ping of the broadcast address 255.255.255.255 which *depending on the configuration* it might respond to (most systems default to responding) ... since the system is on a different subnet though it's likely it won't respond directly to you but it may try and talk to the gateway to route to you and then hopefully you might get an ARP request as above ... It is possible the host doesn't actually have a gateway configured at all though in which case it won't respond to IP packets outside of its local subnet and obviously won't be ARPing for a gateway ... In that case your best bet is to carry out the tcpdump still and parse it for any unexpected IP addresses.... If your network is small enough and you have a managed switch you could also make a list of known MAC addresses via a broadcast ping and then look at the switch tables to see what MAC addresses have been learned ... find whichever MAC address (assuming that the device has made any attempt to contact something at all on the network...) is in there that's not on your list and see which port it's assigned to and cable trace .... That won't get you an IP directly as per your OP but you could then check the system... Is this an academic question or do you have specific issue you're trying to solve?