Re: MAC address spoofing - conflict?

In general a hub represents multiple physical ports on a single collision domain. That being the case I would think that all network cards on that collision domain would get the packet.
-Scott

Lubos Kolouch wrote:
Yes, but what will happen then? Data will be sent to that MAC address.

If it is switched network, I can imagine the switch will maybe send it
to the correct port from which the response came?

If there is a hub though, the packet will be delivered to which network
card?

Lubos Kolouch

Cedric Blancher píše v Čt 17. 08. 2006 v 08:56 +0200:
Le mercredi 16 août 2006 à 10:26 +0200, Lubos Kolouch a écrit :
I think it does matter. Because there will be more than host replying to
ARP broadcasts and the question is what will happen.
Nope it does not matter, because you won't have multiple answers...

ARP asks for an _IP_ address, not a MAC one. Therefore, if MAC addresses
are identical, but IP addresses are different, an ARP request for one
given IP address will get one answer only. In the end, you will end up
with two entries in ARP cache with the same MAC address, but there's not
problem out there.

And if, in case of some wierd and unexplained behaviour (aka awful bug),
both hosts were replying, they would reply with the same MAC address to
the same request, so you would not have problem either.

Le jeudi 17 août 2006 à 01:03 +0000, penetrationtestmail@xxxxxxxxx a
écrit :
And if anyone knows the exact answer, that would be most helpful ;)
The exact answer is: you can seamless spoof MAC addresses on WLAN as
long as you use a different IP address than spoofed host, so you don't
have TCP RST problems and stuff like this. Tested in lab and real life
for pentests.

It's a classical technic (among others[1]) for bypassing some cheap, but
still widespread, WLAN captive portal that only track authenticated
clients with their MAC address.


[1] http://sid.rstack.org/pres/0602_ESW_CaptiveBypass.pdf


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------






--
Scott Davidson, CISSP, SCSP, CCNA
scott@xxxxxxxxxx - dogtentx on Yahoo IM
MOB 214-632-6191
FAX 440-658-6191




------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------

Relevant Pages

  • RE: Re: MAC address spoofing - conflict?
    ... This discussion has wandered well outside the realms of penetration testing ... Maybe you are getting a little confused about ap and arp. ... no client mac address is going to appear in the arp table of the ap. ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Leopard Sidebar Question
    ... (But if you've rebooted your Mac that will clear the arp table. ... it's handy for cases like Apple which have their own network interface devices. ... For example the internal interface for my firewall box, a soerkris 4801, give me "SiByte, Inc" which doesn't really help that much, on the other hand the MAC for my Wii does return Nintendo. ... the situation is rather surprising. ...
    (comp.sys.mac.system)
  • Re: get MAC Address from IP
    ... a machine may have multiple IP addresses and multiple MAC ... Its called ARP. ... Also, IN GENERAL, it's a bad idea for code which is not running the network ... Note that the network layer won't be troubled by this change, ...
    (microsoft.public.dotnet.general)
  • Re: scan for machines in the subnet
    ... still respond to an ARP packet addressed to it's IP address. ... A switch on a meshed network can reply to ARP with it's own MAC. ... They don't change often, fortunately - but I'm reconfiguring things at the moment, and that means each manually configured server, workstation and printer must be changed. ...
    (comp.os.linux.networking)
  • Re: Using ARP to map a network
    ... to check if the mac address ... Using ARP to map a network ... > This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)