Re: Detecting MAC Spoofing/reading REAL MAC address

From: Barry Margolin (barry.margolin_at_level3.com)
Date: 07/22/03


Date: Tue, 22 Jul 2003 14:55:52 GMT

In article <ebc4e0b3.0307220623.1b886283@posting.google.com>,
Jorge Muria <jmuria@ole.com> wrote:
>I'm making a program that identifies various PC's in a network by
>their MAC addresses. I though that thay could not be changed but they
>can. It's as easy as changing the attributes in the ethernet
>configuration (Windows 2000/XP).
>
>Now that all my work is almost trash. I have the hope that there is a
>way to know the REAL-HARDWARE Mac address. Or at least if there is a
>way to know if a retreived MAC address is faked (copied from other
>computer).

Nope.

I think the usual solution to this is using a switch that detects when a
MAC address moves to a different port, and either raises an alarm or shuts
down the port.

-- 
Barry Margolin, barry.margolin@level3.com
Level(3), Woburn, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.