I'm trying to scan a network for SIP phones that only respond to pings and http requests. They wont respond to any SIP packets that aren't well-formed.

I'm looking for a way to make a probe to look for a string in the http reply.

It would be great to somehow use ARP to get the MAC of the IP and just filter there....