Re: Promiscuous Mode

On Thursday 20 March 2008 14:27:38 Morgan Reed wrote:
It won't make any difference on a switched network as you won't see
packets not destined for your MAC address anyway (Unless they're
broadcast packets)
...or you arp-flood the appropriate switch.

I have a related question: if your network card is in promisc mode and
assuming you can see the packets at all (because you're on a hub or
something), and someone sends a packet with a MAC address that isn't yours,
but that is addressed to your IP, what is the typical response of the network
stack? Ignore it because the MAC is wrong, or accept it because the IP
address is correct? Does this behaviour vary based on configuration or OS?

PS: Hi Morgan, fancy seeing you here :)

--
Robin <robin@xxxxxxxxxxxxxxx> JabberID: <eythian@xxxxxxxxxxxxxxxxxxxxxx>

Hostes alienigeni me abduxerunt. Qui annus est?

PGP Key 0xA99CEB6D = 5957 6D23 8B16 EFAB FEF8 7175 14D3 6485 A99C EB6D

Attachment: signature.asc
Description: This is a digitally signed message part.

Relevant Pages

  • Writing protocol driver for Raw Packet bridging
    ... catching all packets on one network card and passing it to a second ... But the next step requires commenting out a mac address check (anti- ... // Comment out to support sending packets from any MAC source address ... directly access an NDIS miniport driver. ...
    (microsoft.public.windowsce.platbuilder)
  • [UNIX] Bug in Linux 2.4 and IPTables MAC Match Module
    ... Bug in Linux 2.4 and IPTables MAC Match Module ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... perform NAT, mangle packets, and access custom extensions for packet ...
    (Securiteam)
  • Re: Router stops routing after changing MAC Address
    ... I have a Linux router and I need the ability to swap hardware without ... How to change MAC addresses is documented well enough - and it works - ... ip link set eth0 down ... the right side and back with echo request and reply packets. ...
    (Linux-Kernel)
  • Re: MAC and gateways
    ... So, to get your packets to carry the original MAC address, you are ... the Client thru the Server and is based on something called Sesame ...
    (comp.os.linux.networking)
  • Re: Req: info on IP range popup ad software supposedly called "Extreme Marketing"
    ... >>Now, not only do I have your IP, but I also have your MAC address. ... > You will not see the return packets and the victim will interfere; ... > of customer NICs; however, it also has a record of the cable modem MAC ...
    (comp.security.misc)