MAC address

[rkruz]

Does the source MAC address stay in the datagram throughout its passing though the internet? Or is that replaced with each hop with the new hop source?

[tavon]

The source and destination MAC address changes as it goes through networks only the source and destination IP address stays the same.

[Dai]

Interesting. This is an area where my understanding is a bit vague.

As a packet goes through a series of routing devices does each one substitute it's own MAC address for the source?

That being the case presumably the destination each time is the next 'hop' along the route?

[tavon]

yes that's right

[rkruz]

very good. thank you

[Dai]

Brief but to the point.

Cheers.

[rkruz]

I know all MACs are supposed to be unique.....but....what happens on a LAN if two adapters have identical addresses?

[Jon T]

it plays havoc with ARP requests

http://en.wikipedia.org/wiki/Address...ution_Protocol

[tavon]

Originally Posted by rkruz

I know all MACs are supposed to be unique.....but....what happens on a LAN if two adapters have identical addresses?

MAC Addresses are controlled by the Institute of Electrical and Electronics Engineers, it is a 48 bit hexadecimal address the first 24 bits are assigned by the Institute of Electrical and Electronics Engineers as a vendor code, the other 24 bits are for the vendor to give to each Network Interface Card a unique address. there cannot be two Network Interface Cards with the same MAC address.

of course there is MAC address spoofing which can clone a MAC address which can complicates things.

Two hosts with the same IP address on the same network would cause a conflict as Jon T has pointed out.

[rkruz]

How about this also? What happens if you could build a sniffer computer to put on a LAN with a duplicate and valid MAC address. And you build the sniffer to not respond to ARP requests, therefor it does not show in the ARP table with different IP and duplicate MAC. Would this sniffer then happily receive all the data meant for the other duplicated PC without detection by viewing the ARP table.

---------- Post added at 20:47 ---------- Previous post was at 20:41 ----------

Originally Posted by tavon

MAC Addresses are controlled by the Institute of Electrical and Electronics Engineers, it is a 48 bit hexadecimal address the first 24 bits are assigned by the Institute of Electrical and Electronics Engineers as a vendor code, the other 24 bits are for the vendor to give to each Network Interface Card a unique address. there cannot be two Network Interface Cards with the same MAC address.

of course there is MAC address spoofing which can clone a MAC address which can complicates things.

Two hosts with the same IP address on the same network would cause a conflict as Jon T has pointed out.

Its the "can complicate things" I am interested in.

[Dai]

I'm not sure that's an appropriate subject for this forum. Kinda falls into the 'hacking' arena.

[tavon]

Originally Posted by DaiNasty

I'm not sure that's an appropriate subject for this forum. Kinda falls into the 'hacking' arena.

I agree, there are very few legitimate reasons for cloning a MAC address.

[rkruz]

Originally Posted by tavon

I agree, there are very few legitimate reasons for cloning a MAC address.

you are not informed then. To suggest this is not an appropriate topic is simply ignorance. There are many legitimate reasons for cloning a MAC address. I will mention but a few.

Legitimate uses of MAC spoofing
An example of a legitimate use of MAC spoofing is hanging the function of a single computer from a router to computer and back to router through MAC spoofing. If you only have a single public IP, you can only hook up one unit
directly (PC or router). If one has two WAN IPs, the MAC address of the two devices must be different. For whatever reason, if one needs to swap 2 PC's regularly to connect to the cable modem, it would be a lot easier to change the MAC addresses rather than to change the Network Interface Card (NIC). Many cable modem routers have a "Clone MAC Address" feature built-in for this. (In reality, the easiest way to enable two machines to access the same ISP from the same location is to use a cable modem router like LinkSys, which allows multiple MACs to use a single ISP connection.)

[Dai]

Originally Posted by rkruz

Legitimate uses of MAC spoofing
An example of a legitimate use of MAC spoofing is hanging the function of a single computer from a router to computer and back to router through MAC spoofing.

One example, but very different to what you were suggesting earlier.

Let's see you make a valid case for a 'sniffer'

[Raistlin]

I'm in agreement with DaiNasty here - if you guys want to avoid the closure of this thread then you need to be very careful.

Whilst a dicussion of the legitimate uses for MAC changing will be tolerated, if you start to drift into topics which breach our Terms of Use or which might be seen to be aiding in illegal activities of any kind (for example theft of service) you will find this thread closed very quickly.

Given the ease with which you can a) find the MAC address of your own PC (or any other PC to which you have legitimate access), and b) change that MAC address, I'm not sure why you would want to build a 'sniffer' of the kind you're asking about.....perhaps you'd care to expand on that slightly to avoid any nasty confusion.....?