Suppose I have a switched subnet. On this subnet I have a machine that does a ping scan of that subnet. If I list the arp cache, then it will give me the MAC address of all the machines that are up. Is it possible to do this to another subnet that is being routed by the same router? What are some remote MAC address enumeration techniques?