MAC address are similar result in similar ip address

Printable View

April 22nd, 2006, 10:34 AM
zillah

MAC address are similar result in similar ip address

By using "a-change MAC address V5.0", I did a test within same LAN, I have got two laptop A and B with Nortel Acess Point.

These laptop are getting IP address form Nortel AP automatically. Type of ip address is 10.70.72.x/24.

IP address for laptop A is 10.70.72.93/24 , and MAC is 00-91-4C-2A-2B-2C.

IP address for laptop B is 10.70.72.141/24, and MAC is 01-80-4C-29-22-29.

I changed the MAC address for laptop B to be same to laptop A (i.e. form 01-80-4C-29-22-29 to 00-91-4C-2A-2B-2C ).

When I changed the MAC address , ip address for B has been changed to be same to the ip address for A as well,,,,,Why ? What is concept ? does it related to ARP protocol ?

I have not received notification message telling me that the are conflict in the ip addresses.

If laptop A tries to access the net first , then Laptop B can not access.

And if laptop B tries to access the net first , then laptop A can not access the net.

I tried to change ip addresses for one of the laptop , and keep MAC address similar for both of them, by configure laptop A manually with existing any ip address within the same LAN (i.e 10.70.72.141/25 has not been assigned to other PC within LAN) ),,,,,result still same I can not
April 22nd, 2006, 11:36 AM
Tiger Shark

The MAC address has to be unique on the local network. It is the address that computers, routers, switches etc. use to communicate locally, (The IP address is not really used locally). Thus if you change the MAC address of Laptop B to match that of Laptop A the router will only send packets to the last known MAC address because it registers the MAC address to a given port on itself.
April 22nd, 2006, 02:38 PM
ZT3000

Because of what Tiger Shark said, in your scenario the result is that the IP addresses are the same due to both devices having the same MAC address.

The router assigns unique IP addresses to devices that have unique MAC addresses and when two devices share a MAC address, then they both get a similar IP address from DHCP BUT communication is *fought* over by each device, due to each device trying to answer the data frames/ethernet packets which bear the same MAC ID/IP address.

Believe it or not, there have been a case I've heard of where the MAC address was the same for a couple devices right out of the factory. It wasn't easy solving that problem if you are not looking for it.
April 22nd, 2006, 03:44 PM
phishphreek

Along with what ZT3000 and TigerShark said...

What you've effectively done is called an arp spoof. You've taken over another machine's physical address. This attack is a layer 2 attack and you've "corrupted" the MAC tables of the switch. (router if you're router has a built in switch). You tricked the DHCP server (doesn't HAVE to be a router) into thinking you're one machine and stolen the ip address for it. (Similar to if someone gets a fake id for identity theft.)

Note: Historically, the router operates at layer 3 and doesn't care about physical address. Now-adays, the lines are blurring between what is a router and a switch. I have layer 3 swtiches (have routing functionality built in) and routers with switches built in!

If you want to play around with some more "arp spoofing" check out tools like Cain and Abel, Ettercap and dsniff. Just make sure you do it on a test network and not a production network. I've accidentally knocked everyone off my production network when trying to sniff traffic between the gateway and a host! ooops! Don't tell anyone... I didn't.

What I *should* have done was span the ports on the switch so I could have seen that hosts traffic. However, I didn't know any better at the time. This was several years ago when I was just learning about this stuff.

<begin phone call>

user: Hi, everyone just seemed to get kicked off the system.
me: <thinking> oh sh17, oh sh17!
me: um... I'm looking into it... ah, yes. here it is. wait about min and and try again.

<end phone call>

I had to stop spoofing and let the switch tables update.

Another place you're likely to see this type of attack is when you're trying to access a secured wireless access point or any switch that has MAC filtering enabled.

At a local LUG I attend, I'm not a registerd student on the campus that hosts it. So, I couldn't access their wireless network to play along with everyone else. One of the LUGGers let me "borrow" a MAC he has registerd with network services for a spare wifi card he has.
April 23rd, 2006, 08:36 AM
zillah

Quote:

The MAC address has to be unique on the local network. It is the address that computers, routers, switches etc. use to communicate locally, (The IP address is not really used locally).

Yes you are right.
Cisco curriculum CCNA2 V3.2 9.1.4 says:

Quote:

A data link layer address is necessary because delivery within the network is determined by the address in the Layer 2 frame header.

and in other article, it says:

Quote:

Layer 2 switching takes place within the LAN. Layer 3 routing move traffic between broadcast domain

Quote:

Thus if you change the MAC address of Laptop B to match that of Laptop A the router will only send packets to the last known MAC address

By "last known MAC" here you meant laptop A,,,didn't you ?

Quote:

because it (router) registers the MAC address to a given port on itself..

In order to clarify my confusion , you have mentioned port number and MAC address , then you meant to say switch not router because :
"A switch dynamically builds and maintains a content-addressable memory (CAM) table, which holds all of the necessary MAC information for each port". And "Router dynamically build ARP table which holds MAC address and IP address".
April 23rd, 2006, 08:57 AM
zillah

Quote:

Believe it or not, there have been a case I've heard of where the MAC address was the same for a couple devices right out of the factory. It wasn't easy solving that problem if you are not looking for it.

The author for these two books Agree with what you have seen

The author for these agree with what you have seen:

1- "Data Communications and Networking" by Behrouz A. Forouzan, Ed3, Chapter 20, page 512 :

Quote:

A MAC address is a local address. Its jurisdiction is a local network. It should be unique locally, but not necessarily universally

2- He mentioned in another book “TCP/!P Protocol Suite” , E3, Chapter 7,
Section 7.3 RARP, page173 :

Quote:

The machine can get its physical address (by reading its NIC, for example), which is unique locally

.
April 23rd, 2006, 09:14 AM
zillah

Quote:

What you've effectively done is called an arp spoof. You've taken over another machine's physical address. This attack is a layer 2 attack and you've "corrupted" the MAC tables of the switch. (router if you're router has a built in switch)

Do you mean if the CAM table for the switch has got two identical MAC addresses it will be corrupted ?

Quote:

You tricked the DHCP server (doesn't HAVE to be a router) into thinking you're one machine and stolen the ip address for it. (Similar to if someone gets a fake id for identity theft.)

Since I am doing this test at work, and the Nortel AP is connected to a switch (guessing not sure), and since the CAM table for a switch is corrupted; why I am getting same ip address if the CAM table is corrupted ?

Quote:

What I *should* have done was span the ports on the switch so I could have seen that hosts traffic.

You meant Promiscuous mode.
April 23rd, 2006, 09:53 AM
sec_ware

Hi

Quote:

Since I am doing this test at work, and the Nortel AP is connected to a switch (guessing not sure),
and since the CAM table for a switch is corrupted; why I am getting same ip address if the CAM table
is corrupted ?

This has nothing to do with the switch. As phishphreek80 stated, the DHCP server thought
that Laptop B is Laptop A and thus served Laptop A's IP number to Laptop B. The reason for
this is that the DHCP server maintains a Lease-table: MAC address <-> IP number. Usually,
a Lease is valid for a certain time, and thus Laptop B, which identified itself with the MAC
address of Laptop A, got the IP number previously assigned to Laptop A.

Quote:

You meant Promiscuous mode.

No, he did not mean Promiscuous mode per se. While it is true that a NIC in promiscuous
mode will allow to "sniff all packets", these packets first has to come to the NIC.
A switch will send a packet (or rather frame since we are talking layer 2) only along the
relevant physical line, at which end the NIC with the target MAC address is present. A
spanning port configures the switch to behave like a hub for [a] specific port[s]. Hence,
you effectively copy the traffic from all ports to a single port, which allows you to analyse
all traffic even in a switched network.

Cheers.
April 23rd, 2006, 10:30 AM
zillah

Quote:

No, he did not mean Promiscuous mode per se

Thanks for this correction. yes he meant Switch Port Analyzer (SPAN), which i used to configure it on a cisco switch.
April 23rd, 2006, 03:51 PM
zillah

Quote:

If laptop A tries to access the net first , then Laptop B can not access.

And if laptop B tries to access the net first , then laptop A can not access the net.

Now since we have two laptop with same MACs and same IPs (we knew, why they have got the same IPs),,if we have been asked why when one laptop access the internet first the second can not,,,,what should be the answer ?
April 23rd, 2006, 04:30 PM
Tiger Shark

Because the switch logs the IP address to the _physical_ port the request for the net came in on and updates it's MAC table accordingly. Thus, once the response from the server comes back it is sent to the port that the request came in on. The switch will not simply keep updating it's tables for every single request because that would cause havoc on the network so once the first laptop has "reserved" the port on the switch then it will stay there in the switches table until something significant happens to alter it.
April 23rd, 2006, 04:45 PM
zillah

Thanks Tiger Shark

1- What will the explaination be if that AP is connected to cisco router directly (there is no switch, that means there is no CAM table) ?

2- What will the the explaination be if I want to do the same test at home with ADASL linksys router ?
April 23rd, 2006, 07:06 PM
ZT3000

Quote:

Originally posted here by zillah
Now since we have two laptop with same MACs and same IPs (we knew, why they have got the same IPs),,if we have been asked why when one laptop access the internet first the second can not,,,,what should be the answer ?

For my answer, I would first ask, What topology are we discussing?
There are great differences depending on the topology.

Which one? Star, Bus, Ring, Tree, Mesh??

(I'm supposing you are using STAR, but still it's smarter to ask which topology first).
April 23rd, 2006, 08:44 PM
zillah

Quote:

For my answer, I would first ask, What topology are we discussing?

Star topolgy

1- First Secnario AP is connected to a cisco router 2600 directly without switch , both laptops are connecting to the AP wirelessly.

2- Second scenario AP is connected to a cisco switch 2900 and a switch is connected to a cisco router , both laptops are connecting to the AP wirelessly.
April 23rd, 2006, 08:45 PM
Nokia

It is possible to have two identical MAC addresses on a network - they can be on different VLANS or different internetworks - I.E on different interfaces on a router and even on the same swich, depending on the make on model of it.

They will not have 100% functionality, but they will have some.

A switch will update its filter table as and when it needs to and will periodicaly flush entries that have not been active.

If two MAC's connected to the same switch they would be entered on to the table (on CISCO some 2900 series and below there is no duplicate MAC address checks) - data will be passed to either host depending on where they come in the table - the table is parsed until it comes to an entry that matches the destination MAC - once it has found the entry, the frame is passed out of the correct port - the table is not searched in its entirity only until if finds a matching entry.

Hence you can send data out but are not guarenteed to receive any. :p
April 23rd, 2006, 09:27 PM
zillah

Quote:

It is possible to have two identical MAC addresses on a network - they can be on different VLANS or different internetworks - I.E on different interfaces on a router and even on the same swich, depending on the make on model of it.

Since it is possible to have two identical MAC,,,what did you mean by "depending on the make on model of it"

Quote:

If two MAC's connected to the same switch they would be entered on to the table (on CISCO some 2900 series and below there is no duplicate MAC address checks)

You meant that the process of learning (building CAM table) can map same MAC address to two different ports,,,didn't you ?

IP address for laptop A is 10.70.72.93/24 , and MAC is 00-91-4C-2A-2B-2C.say this is connec
IP address for laptop B is 10.70.72.141/24, and MAC is 01-80-4C-29-22-29.

Quote:

data will be passed to either host depending on where they come in the table - the table is parsed until it comes to an entry that matches the destination MAC - once it has found the entry, the frame is passed out of the correct port

Suppose (my real sceanrio not like this ) I have got laptop A with IP address 10.70.72.93/24 , and MAC is 00-91-4C-2A-2B-2C connected wired to port 10

I have got laptop B with IP address 10.70.72.93/24 (has been changed after I modified its MAC), and MAC 00-91-4C-2A-2B-2C (same as A) connected wired to port 20

Laptop C with ip address 10.70.72.150/24 , and MAC CC-3C-4C-22-33-33 connected wired to port 30

Now CAM table will be:

Code:

MAC Port 00-91-4C-2A-2B-2C 10 00-91-4C-2A-2B-2C 20 CC-3C-4C-22-33-33 30

Now if laptop C (MAC CC-3C-4C-22-33-33 port 30) tries to send frame to Laptop with MAC address 00-91-4C-2A-2B-2C how does the switch know the traffic should exit from which port ?
April 23rd, 2006, 09:33 PM
zillah

If I have got 3 or 4 PCs connected to AP wirelessly, and that AP is connected to a cisco switch wired,,,Does't the cisco switch build CAM table for MAC address for AP only ?
April 23rd, 2006, 10:58 PM
Nokia

Hello mate,

Quote:

Since it is possible to have two identical MAC,,,what did you mean by depending on the make on model of it

I meant you can have two MAC's on the same switch depending on the make and model of the switch - some of the more intelligent switches will activly look for duplicate MAC's in its filter table and some won't.
Now I am not saying that you will be able to send or receive any frames, all I am saying is some switches will keep both entries in it's table.

Quote:

Suppose (my real sceanrio not like this ) I have got laptop A with IP address 10.70.72.93/24 , and MAC is 00-91-4C-2A-2B-2C connected wired to port 10

I have got laptop B with IP address 10.70.72.93/24 (has been changed after I modified its MAC), and MAC 00-91-4C-2A-2B-2C (same as A) connected wired to port 20

Laptop C with ip address 10.70.72.150/24 , and MAC CC-3C-4C-22-33-33 connected wired to port 30

Now CAM table will be:

Code:

MAC Port 00-91-4C-2A-2B-2C 10 00-91-4C-2A-2B-2C 20 CC-3C-4C-22-33-33 30

Now if laptop C (MAC CC-3C-4C-22-33-33 port 30) tries to send frame to Laptop with MAC address 00-91-4C-2A-2B-2C how does the switch know the traffic should exit from which port ? [/B]

A CAM table is updated by what is known as 'last packet updates' - as the name suggests if you duplicated a MAC on say port 1 and sent a frame out to another port the table will be updated with your spoofed MAC as being on port 1 - some switches will now delete the real MAC from its table and some will just leave it there.

If it gets deleted you will effectivley own that MAC and receive traffic destined for that host, untill the real host sends a frame through the switch - then as that is the 'last packet'[updates] to be received from that MAC the switch will now update itself accordingly.

If you happen to be on a switch that doesn't actively search for duplicate MAC's it will now have two entries for the MAC - when it parses its table now, as soon as it comes across the relevant MAC it will stop parsing and send the frame. So if your entry is higher up in the filter table than the other one you will get the data, if not the other host will get the data.

Quote:

Originally posted here by zillah
If I have got 3 or 4 PCs connected to AP wirelessly, and that AP is connected to a cisco switch wired,,,Does't the cisco switch build CAM table for MAC address for AP only ?

More than one MAC can be assosiated with a port.
A wireless AP is infact a hub, so say you had 4 hosts on the AP and the AP was wired in to port 1 on the switch, the switch would have 4 MACs assosiated with the port - it would just send the frame out of the port, the frame would reach the hub and obviously go out to all hosts.

Hope it helped!
April 23rd, 2006, 11:19 PM
Nokia

One thing I forgot to mention, some of the catalyst switchs use the Timeout method for MAC filtering. 300 secs (5 mins) is the default - so if it has not received or sent any traffic to the MAC for 300 seconds it is flushed from the table.

This is good for bigger networks as IIRC the max size for a CAM table is 8000 entries - but it is usually altered or even disabled on smaller networks to reduce the ammount of time taken in the switching process.
April 23rd, 2006, 11:25 PM
Nokia

Quote:

Because the switch logs the IP address to the _physical_ port the request for the net came in on and updates it's MAC table accordingly. Thus, once the response from the server comes back it is sent to the port that the request came in on. The switch will not simply keep updating it's tables for every single request because that would cause havoc on the network so once the first laptop has "reserved" the port on the switch then it will stay there in the switches table until something significant happens to alter it.

I take it the first part about a switch loging IP addresses to a port was a typo! You meant MAC address of course, since we are talking layer 2 switches!

Switches will and do constanlty update/check their tables - some use 'last packet updates' and others use default timeouts.
April 23rd, 2006, 11:31 PM
Nokia

Quote:

Originally posted here by Tiger Shark
The MAC address has to be unique on the local network. ......Thus if you change the MAC address of Laptop B to match that of Laptop A the router will only send packets to the last known MAC address because it registers the MAC address to a given port on itself.

TS?????? :eek:

Routers do not send packets via MAC address or even care about MAC address - the forward them out on an interface using its IP address - and not the IP of the host, only the network portion of the IP - they deal with networks and don't care about hosts.

so a packet destined for 192.168.2.1/24 will go out of the interface that has the 192.168.2.0 network attached to it - at no time is the MAC looked at.
When it gets out of the interface it will come to a switch - then the MAC address is looked at - the next time the IP is used is when it gets to the host and is double checked to by the host to ensure that the packet is indeed for that host.
April 24th, 2006, 12:07 AM
ZT3000

Quote:

Originally posted here by Tiger Shark
The MAC address has to be unique on the local network. It is the address that computers, routers, switches etc. use to communicate locally, (The IP address is not really used locally). Thus if you change the MAC address of Laptop B to match that of Laptop A the router will only send packets to the last known MAC address because it registers the MAC address to a given port on itself.

Nokia,

Obviously TS knows his stuff, we all know that!

Just change the mistyped word "router" to "switch". EZ.

Quote:

Nokia wrote: .....or even care about MAC address

Oh yeah?
Prove that statement.

(have fun trying).

:D
April 24th, 2006, 12:27 AM
Nokia

Well, if you can manage to extract your head out of TS's arse for a brief moment maybe you can mosey on over to CISCO and take a look at what happens to a frame when it is sent to one interface on a router and out of another one - on a normal network, since we are not talking VLANS and ACL's here.

And then inset head back in to TS's arse before you get confused and lonley.
April 24th, 2006, 12:59 AM
ZT3000

Quote:

Originally posted here by Nokia
Well, if you can manage to extract your head out of TS's arse for a brief moment maybe you can mosey on over to CISCO and take a look at what happens to a frame when it is sent to one interface on a router and out of another one - on a normal network, since we are not talking VLANS and ACL's here.

And then inset head back in to TS's arse before you get confused and lonley.

What?? No smiley

:D

Don't need to mosey anywhere dude.

Routers use MAC's on DHCP and even have a MAC ID on both WLAN interface and LAN interface. Some ISP's check the MAC address and won't allow connection unless the router has the right address.

(Edit: I'll give the readers three guesses who negged this post and the first two guesses don't count.)
April 24th, 2006, 01:03 AM
Nokia

Quote:

nd even have a MAC ID on both WLAN interface and LAN interface.

Routers have a MAC ID on every interface otherwise it would not receive any frames but how does that fit in to how a router takes a packet from on internetwork and send it out on to another, which is what we are talking about?

I'll answer for you - It doesnt.

Other devices need to know the MAC of the router to send packets to it - but like I said, a router does not need to know the destination MAC of the packet it is routing - only the IP of it.
April 24th, 2006, 01:11 AM
ZT3000

I'm sorry if I was wrong.

Quote:

Originally posted here by Tiger Shark:
The MAC address has to be unique on the local network. It is the address that computers, routers, switches etc. use to communicate locally,

This is the discussion I was referring to and of which you quoted.
A local network.
April 24th, 2006, 01:22 AM
Tiger Shark

Oh Girls... I did and I didn't mistype router in this situation... I was thinking a home Cable/DSL "router"/firewall which is a switch too... It was mistyped but it wasn't.

However, in a PM to the OP I did start woffling on about _routers_ and have since corrected myself... :p
April 24th, 2006, 05:27 AM
zillah

Thanks Nokia

Quote:

as the name suggests if you duplicated a MAC on say port 1 and sent a frame out to another port the table will be updated with your spoofed MAC as being on port 1 - some switches will now delete the real MAC from its table and some will just leave it there.

This is with the scenario of AP which is connected wired to a switch and since PCs accessing AP wirelessly. Then a switch holds in its CAM table different MACs with the same port.

Quote:

More than one MAC can be assosiated with a port.
A wireless AP is infact a hub, so say you had 4 hosts on the AP and the AP was wired in to port 1 on the switch, the switch would have 4 MACs assosiated with the port

Second scenarion, If I have got two or three PCs connected wired directly to a switch (no AP), then I will get dublicate MAC addresses on different ports (not same port),,,,this is what I meant by

Quote:

Suppose (my real sceanrio not like this ) I have got laptop A with IP address 10.70.72.93/24 , and MAC is 00-91-4C-2A-2B-2C connected wired to port 10,,,,,,

Since you explained the porcess of 'last packet updates' for a duplicate MAC on same port (thanks) , How does 'last packet updates' behave with a duplicate MAC on different ports (not same port) ?

Quote:

when it parses its table now, as soon as it comes across the relevant MAC it will stop parsing and send the frame.

It is similar to ACL it starts checking from the top of a list as long as it finds match , it does not go further

Quote:

30 secs is the default

What i found in cisco curriculum it is 300 sec

Quote:

More than one MAC can be assosiated with a port.
A wireless AP is infact a hub, so say you had 4 hosts on the AP and the AP was wired in to port 1 on the switch, the switch would have 4 MACs assosiated with the port - it would just send the frame out of the port, the frame would reach the hub and obviously go out to all hosts

.
As you know that an AP has MAC address, why does the switch not include the AP's MAC within its CAM table, shouldn't be 5 MACs instead of 4 MACs ?
April 24th, 2006, 10:42 AM
Nokia

Quote:

Second scenarion, If I have got two or three PCs connected wired directly to a switch (no AP), then I will get dublicate MAC addresses on different ports (not same port),,,,this is what I meant by

Suppose (my real sceanrio not like this ) I have got laptop A with IP address 10.70.72.93/24 , and MAC is 00-91-4C-2A-2B-2C connected wired to port 10,,,,,,

Since you explained the porcess of 'last packet updates' for a duplicate MAC on same port (thanks) , How does 'last packet updates' behave with a duplicate MAC on different ports (not same port) ?

Sorry mate maybe I didnt explain it well, if a switch is using 'last packet updates' for it's update process it will use it across all ports, depending on how the switch is configured it will either:

Associate the MAC with the new port and do nothing else
Associate the MAC with the new port and delete the original entry
Stop the new MAC from binding with a port and either lock the port out completley or lock the MAC ouit completley.

A lot of it depends on the make/model and configuration of the switch. Usually in the older switches running last packet updates - say you have the mac address of A1 attachetd to port 2 - you now spoof your MAC to also be A1 and attach it to port 5. When you send a frame through the switch yours will be the last packet to update that switch of what port the MAC of A1 is connected to - so the switch (depending on config) will delete the first entry, (presuming the actual host as been moved) and associate you with A1 - until the other host sends a packet then the same process will happen to you.

Quote:

Since you explained the porcess of 'last packet updates' for a duplicate MAC on same port

This is not what I was getting at - if you have a think about that statement you will realise it doesn't make total sense. How can you have a duplicate MAC on the same port, as far as the switch will concerned there will be one host with that MAC attached to the port, it has no way of knowing there are two hosts with the same MAC - It will still be the one entry for the MAC address.

Quote:

30 secs is the default

What i found in cisco curriculum it is 300 sec

Ooops sorry, typo - OP edited - 5 mins is the default.

Quote:

More than one MAC can be assosiated with a port.
A wireless AP is infact a hub, so say you had 4 hosts on the AP and the AP was wired in to port 1 on the switch, the switch would have 4 MACs assosiated with the port - it would just send the frame out of the port, the frame would reach the hub and obviously go out to all hosts
.
As you know that an AP has MAC address, why does the switch not include the AP's MAC within its CAM table, shouldn't be 5 MACs instead of 4 MACs ?

This depends - if you think about the learning process of a switch - a MAC is only added to the filter table once a frame has either been sent or received from the host - if the only hosts to send or receive traffic are the four hosts attached to the AP then only these four MACs will be entered on the table - once the the actual AP sends or receives a frame then this MAC will also be added to the table.
April 24th, 2006, 11:05 AM
zillah

Thanks Nokia

Quote:

This is not what I was getting at - if you have a think about that statement you will realise it doesn't make total sense. How can you have a duplicate MAC on the same port,

Yes you are right. My understanding to the below quoted statement was (mistakenly ) duplicate MAC on the same port

Quote:

as the name suggests if you duplicated a MAC on say port 1

Quote:

one host with that MAC attached to the port, it has no way of knowing there are two hosts with the same MAC - It will still be the one entry for the MAC address.

Yes you are right. But we can have different MAC addresses mapped with the same port number in case if the PCs are connected to a hub and that hub is connected to a switch
April 24th, 2006, 11:19 AM
Nokia

Yep you can have as many different macs mapped to the same port as is neccesary and aslong as there is room in the filter table to store them.