02-09-2004, 18:22
|
#1
|
|
Inactive
Join Date: Dec 2003
Location: grimsby
Posts: 6
|
What is mac spoofing
can someone tell me what this means when i ckecked on my pc sygate Personal firewall today it was flashing red with the following message
Unsolicited incoming ARP reply detected, this is a kind of MAC spoofing that may consequently do harm to your computer.
Packet data is shown in the right window.
0000: 00 50 FC A0 08 66 00 0A : 42 68 70 A8 08 06 00 01 | .P...f..Bhp.....
0010: 08 00 06 04 00 02 00 0A : 42 68 70 A8 51 67 F3 FE | ........Bhp.Qg..
0020: 00 50 FC A0 08 66 51 67 : F3 76 20 20 20 20 20 20 | .P...fQg.v
0030: 20 20 20 20 20 20 20 20 : 20 20 20 20 |
|
|
|
|
02-09-2004, 18:59
|
#2
|
|
Inactive
Join Date: Jul 2004
Location: 127.0.0.1
Services: 50MB Virgin w/ TiVo 1TB
Posts: 1,255
|
Re: What is mac spoofing
Uh..Just about the only thing I can tell you about that...is that its hex. A Hex editor will help? Correct me if I'm wrong.
__________________
Emancipate yourselves from mental slavery, none but ourselves can free our minds - Bob Marley
|
|
|
|
|
02-09-2004, 19:35
|
#3
|
|
Inactive
Join Date: Nov 2003
Location: Leeds - the dog house
Age: 49
Services: Email me for a current price list
Posts: 8,270
|
Re: What is mac spoofing
AFAIK, you send out an ARP request to discover an IP address for a given MAC. If you get a reply but haven't asked, then I guess that would be dodgy.
|
|
|
|
|
02-09-2004, 20:12
|
#4
|
|
Dr Pepper Addict
Cable Forum Admin
Join Date: Oct 2003
Location: Nottingham
Age: 63
Services: Zen & YouFibre FTTP, Sky Q TV, Sky Mobile, Flextel SIP
Posts: 31,382
|
Re: What is mac spoofing
Quote:
|
Originally Posted by taz2k2
can someone tell me what this means when i ckecked on my pc sygate Personal firewall today it was flashing red with the following message
Unsolicited incoming ARP reply detected, this is a kind of MAC spoofing that may consequently do harm to your computer.
Packet data is shown in the right window.
0000: 00 50 FC A0 08 66 00 0A : 42 68 70 A8 08 06 00 01 | .P...f..Bhp.....
0010: 08 00 06 04 00 02 00 0A : 42 68 70 A8 51 67 F3 FE | ........Bhp.Qg..
0020: 00 50 FC A0 08 66 51 67 : F3 76 20 20 20 20 20 20 | .P...fQg.v
0030: 20 20 20 20 20 20 20 20 : 20 20 20 20 |
|
Having decoded it - it basically means sygate lied to you. 
That is a genuine ARP reply packet directed at your IP address telling you the MAC address for your local default gateway. 
__________________
 Baby, I was born this way.
|
|
|
|
|
02-09-2004, 20:38
|
#5
|
|
Inactive
Join Date: Dec 2003
Location: grimsby
Posts: 6
|
Re: What is mac spoofing
ok thanks for the info clearing it up
|
|
|
|
|
02-09-2004, 23:29
|
#6
|
|
Inactive
Join Date: Nov 2003
Location: Leeds - the dog house
Age: 49
Services: Email me for a current price list
Posts: 8,270
|
Re: What is mac spoofing
Quote:
|
Originally Posted by Paul M
Having decoded it - it basically means sygate lied to you.
That is a genuine ARP reply packet directed at your IP address telling you the MAC address for your local default gateway. |
A connection issue maybe? If the firewall is doing stateful inspection of packets and the reply occurred too long after the request? Just a guess...
|
|
|
|
|
02-09-2004, 23:40
|
#7
|
|
Dr Pepper Addict
Cable Forum Admin
Join Date: Oct 2003
Location: Nottingham
Age: 63
Services: Zen & YouFibre FTTP, Sky Q TV, Sky Mobile, Flextel SIP
Posts: 31,382
|
Re: What is mac spoofing
Quote:
|
Originally Posted by greencreeper
A connection issue maybe? If the firewall is doing stateful inspection of packets and the reply occurred too long after the request? Just a guess...
|
More likely the gateway was just too busy to reply in time. Either way, it wasn't an "Unsolicited incoming ARP reply" - just a slow reply.
__________________
Baby, I was born this way.
|
|
|
|
|
02-09-2004, 23:46
|
#8
|
|
Inactive
Join Date: Nov 2003
Location: Leeds - the dog house
Age: 49
Services: Email me for a current price list
Posts: 8,270
|
Re: What is mac spoofing
Quote:
|
Originally Posted by Paul M
More likely the gateway was just too busy to reply in time. Either way, it wasn't an "Unsolicited incoming ARP reply" - just a slow reply. |
One day programmers will take care to ensure that warning and error messages are accurate
|
|
|
|
Posting Rules
|
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is Off
|
|
|
All times are GMT. The time now is 08:13.
|
Join CF
You are here: 
