Re: Detecting MAC Spoofing/reading REAL MAC address

From: Barry Margolin (barry.margolin_at_level3.com)
Date: 07/22/03 

Date: Tue, 22 Jul 2003 14:55:52 GMT

In article <ebc4e0b3.0307220623.1b886283@posting.google.com>,
Jorge Muria <jmuria@ole.com> wrote:
>I'm making a program that identifies various PC's in a network by
>their MAC addresses. I though that thay could not be changed but they
>can. It's as easy as changing the attributes in the ethernet
>configuration (Windows 2000/XP).
>
>Now that all my work is almost trash. I have the hope that there is a
>way to know the REAL-HARDWARE Mac address. Or at least if there is a
>way to know if a retreived MAC address is faked (copied from other
>computer).

Nope.

I think the usual solution to this is using a switch that detects when a
MAC address moves to a different port, and either raises an alarm or shuts
down the port. 

-- 
Barry Margolin, barry.margolin@level3.com
Level(3), Woburn, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.

Relevant Pages

  • RE: How to find a changing IP on ethernet network
    ... called "port security". ... tell it how many MAC ... to issue an SMTP trap to your Network Management ...
    (Security-Basics)
  • Re: Networking over mains cables
    ... blocking just about every port except the basic ones needed to ... without blocking him completely it was useable. ... When entering a network key, ... allow the MAC addresses of the machines I know about. ...
    (comp.sys.acorn.networking)
  • Re: How Do I Keep Private Computers Off of Our Network?
    ... I recommend enabling port security on on all the switches; ... port to the system's MAC address and then disabling the unused ports. ... If you really need to lock it down then Network Access Control through ... are using their business computer's wired connection to connect ...
    (microsoft.public.windows.server.active_directory)
  • Re: Not able to print to shared OS X printer
    ... I've been printing to that exact Brother ... > It's shared, via a Mac running OS X, over the network. ... My guess - and I have no way of testing this, is that Mac users don't ... transmit on cups port but transmit on afp over tcp port and thus ...
    (Fedora)
  • Re: Wireless Network in Public Places Options
    ... and implement a static bridging table. ... >> allows traffic to one other ethernet port, ... source MAC addresses. ... Packets with no destination addresses such as broadcasts and DHCP ...
    (microsoft.public.win2000.networking)