RE: mac duplication

From: Demar, Jeremy D CTM1 (CCDG12 Aug) (DemarJD_at_ccdg12.navy.mil)
Date: 12/14/03

  • Next message: Valdis.Kletnieks_at_vt.edu: "Re: mac duplication" 
    To: vuln-dev@securityfocus.com
Date: Sun, 14 Dec 2003 14:48:30 -0500

    Another solution you could use depends on your switch. I've used several
    that allow you to do port mirroring. All you would have to do is tell the
    switch to mirror the port that the computer you want to monitor is on to the
    one your sniffer computer is on and turn on your sniffer. All traffic
    destined for your target will be copied to you. I used a similar setup for
    running snort and mirroring the port that my router was on.

    Jeremy

    -----Original Message-----
    From: Jimi Thompson [mailto:jimit@myrealbox.com]
    Sent: Saturday, December 13, 2003 7:34 PM
    To: vuln-dev@securityfocus.com
    Subject: Re: mac duplication

    Dev,

    You seem to need some clarification about how Ethernet actually works.
    I'm going to try to toss out a 50,000 foot view. Anyone can feel free
    to add to this or correct me. Host names map to IP addresses via DNS.
    IP address map to MAC addresses via router tables. Just as your IP
    address has to be unique in order to be routable, so does your MAC
    address. MAC addresses are purchased in blocks by the people who make
    network devices and blown on to what amount to EPROMS and attached to
    network cards, switch ports, etc.

    No two ethernet cards on the planet should have the same MAC address
    (emphasis on SHOULD because I've run into cards with duplicated MAC's
    and you won't believe the havoc this wreaks). This is used as a
    physical layer address by things like ARP.
    If you want to sniff traffic to a particular machine, get yourself a hub
    (NOT a switch) and plug the switch into the uplink on the hub and your
    sniffer and sniff-ee into the hub ports.

    This will A) let you see everything and B) not cause any serious
    problems for your switch. I hope that no one was using the machine you
    were trying to sniff because chances are you are causing a DOS situation
    by duplicating the MAC address.

    Jimi

    Dev wrote:

    >hi ppl, please redirect me to a different mailing list if this is not the
    appropriate list to post to.
    >
    >I did the following experiment:
    >
    >I have a switched ethernet network in my university.
    >I wanted to capture packets meant for a certain machine on a different port
    of a Dlink switch. I thought that arp poisoning would be too noisy -
    arpwatch can catch it, & its too bulky for the MITM machine (in case we are
    poisoning a heavily loaded server machine.)
    >& So i duplicated the mac of the victim machine on my own machine.
    >
    >What i saw was this:
    >
    >ping packet drop rate for any of the two machines from a third machine
    varied from 40 to almost 80 %. Also say telnet sessions to any of the two
    machines (which had now the same mac addresses) worked with notable 4-5
    second lockups.
    >
    >Further i could not ping the other machine from one of the duplicated
    machines. (the last one is okay - it makes a lot of sense)
    >
    >My premise is that the problem in connectivity is coming becoz the OS does
    not fall back to half duplex mode when two machines take up the same mac
    address??
    >
    >can anyone plz tell me about the behaviour. How do i set up mac duplication
    in that case so that i can sniff data.
    >
    >I dont want to hurt network performance. & so dont want to do mac flooding.
    Anyways i m not even sure the switches we have here would resort to
    broadcast mode in case of mac flooding.
    >
    >Last but not the least its my second message to the list, & people were
    really helpful in discussing about my queries in my first message.
    >
    >Mailing lists rock..
    >
    >Devrat
    >
    >
    >
    >

  • Next message: Valdis.Kletnieks_at_vt.edu: "Re: mac duplication"

    Relevant Pages

    • RE: Exploit code for IP Smart Spoofing
      ... If there is a MAC violation, this is logged and the port is ... traffic of one other host on the switch. ... but there is no way to protect against ...
      (Bugtraq)
    • Re: Ethernet switch flooding packets?
      ... course) so will have it's own MAC address. ... other VLANs there are are or how many hosts each has. ... was merely using the Ethernet switching terminology - if a switch ... doesn't know which individual port to push a frame out to, ...
      (comp.dcom.lans.ethernet)
    • Re: Network scanning
      ... that works with a radius server to auth mac address at port ... level before the switch will enable that port... ... new MAC and disable the port. ...
      (Security-Basics)
    • Re: Sniffing Internet Traffic
      ... >NIC's MAC to the new port so it can pass traffic. ... >for security because MITM ARP attacks are futile as the switch already ... >I don't know a whole lot about cable modems, but my guess is that, like ...
      (Security-Basics)
    • RE: mac duplication
      ... MAC addresses are globally unique. ... What a switch does when it sees a duplicated MAC is completely arbitrary... ... And for the interval between updates, the packets get routed only to that ... > duplication in that case so that i can sniff data. ...
      (Vuln-Dev)