I am trying to connect to a SunOS 5.5.1 system that doesn't have a monitor
or keyboard and the serial console shows the boot messages, but no login
prompt.

From these boot messages, I was able to see ethernet hardware address and
a gateway address.

I used "tcpdump" to see traffic on my local network to find its IP; some
examples:

 21:13:18.750926 137.134.52.26.33641 > 137.134.255.255.sunrpc:  udp 96
 (DF) [ttl 1]
 21:13:19.421984 arp who-has 137.134.52.1 (Broadcast) tell 137.134.52.26

I want to tell my workstation which has a hub in between it and the Sun
box to be on the same network. Currently, my NetBSD workstation is on a
192.168/16 network.

Of course, if I simply use traceroute (or any other network connection) to
that IP, it goes via my gateway (to my router) and then out to the
internet.

The route(8) manual page says:

  If the destination is directly reachable via an interface requiring no
  intermediary system to act as a gateway, the -interface modifier should
  be specified; the gateway given is the address of this host on the common
  network, indicating the interface to be used for transmission

So I used:

 route add -net -interface 137.134.52 137.134.52.26

And my routing table has:

 137.134.52/24      link#1             UCS         1        0   1500  ne0
 137.134.52.26      08:00:20:7a:3c:1e  UHLc        1     6214   1500  ne0

This is the same hardware address as reported by the SPARCstation boot
messages. Also, "arp -a" shows this hardware address. So I know that the
machine (at least its NIC) is being talked to.

And when I use traceroute, it no longer goes out onto the internet:
 rainier:~$ traceroute -m 2 137.134.52.26
 traceroute to 137.134.52.26 (137.134.52.26), 2 hops max, 40 byte packets
  1  * * *
  2  * * *

But I still can't ping it or see any services (other than with tcpdump).

The boot messages say:
 NIS domainname is seattle
 starting rpc services: rpcbind keyserv ypbind kerbd done.
 Setting default interface for multicast: add net 224.0.0.0: gateway oldss1
 syslog service starting.
 Print services started.

So I used "nmap -P0 -v 137.134.52.26" and then "nmap -P0 -sS -v
137.134.52.26", but after several minutes it never reported results (and
never ended).

Can anyone share some ideas on how I can see the services on the box?

I am guessing my problem has something to do with my routes or network
setup.

My goal is to try to login via telnet, login, or ssh. (Hopefully, it lets
me login with root password because that is all I have.)

(Later, I'll be running NetBSD on the Sun hardware.)

Thanks,

   Jeremy C. Reed
   http://www.reedmedia.net/