MAC - Revision history

Franks at 18:53, 4 December 2005

2005-12-04T18:53:13Z

← Older revision		Revision as of 11:53, 4 December 2005
Line 6:		Line 6:

	To see the MAC addresses of the machines on your subnet:		To see the MAC addresses of the machines on your subnet:
	arp -a		$ arp -a


	== MAC address spoofing ==		== MAC address/arp spoofing ==

			There are a few reasons one might be concerned, or interested about such spoofing:
			#To get past MAC address filtering on a router.
			#Sniffing other connections on the subnet.
			#If someone is using a spoofed MAC address, then the real, burned in MAC address will not show up in IDS/system logs.
			#[[DoS]] (pretending to be the gateway of the subnet, for example).


	[http://slagheap.net/etherspoof/ MacOSX]		[http://slagheap.net/etherspoof/ MacOSX]

	[http://www.klcconsulting.net/Change_MAC_w98.htm Win98]		[http://www.klcconsulting.net/Change_MAC_w98.htm Win98]

			[http://ntsecurity.nu/toolbox/etherchange/ Win2000/WinXP]

	[http://www.bsdatwork.com/2004/06/19/mac_spoofing_on_freebsd/ FreeBSD using netgraph]		[http://www.bsdatwork.com/2004/06/19/mac_spoofing_on_freebsd/ FreeBSD using netgraph]

	[http://whoozoo.co.uk/mac-spoof-linux.htm Linux]		[http://whoozoo.co.uk/mac-spoof-linux.htm Linux]


			Software:

			[http://ettercap.sourceforge.net/ ettercap] is used for man in the middle attacks on LAN.

			[http://www.monkey.org/~dugsong/dsniff/ dsniff] includes arpspoof, dnsspoof, and macof.

Franks at 18:41, 4 December 2005

2005-12-04T18:41:21Z

← Older revision		Revision as of 11:41, 4 December 2005
Line 4:		Line 4:

	A MAC address with all bits sets (also known as FF:FF:FF:FF:FF:FF) is a special address and means that it is a [[broadcast]] (all stations on a LAN are addressed). A MAC address where the first bit is set indicates that this address is a [[multicast]] address. Since the bitorder of Ethernet is [[little endian\|little-endian]] meaning the least significant bit is first it really is the very first bit as the address is read through the Ethernet.		A MAC address with all bits sets (also known as FF:FF:FF:FF:FF:FF) is a special address and means that it is a [[broadcast]] (all stations on a LAN are addressed). A MAC address where the first bit is set indicates that this address is a [[multicast]] address. Since the bitorder of Ethernet is [[little endian\|little-endian]] meaning the least significant bit is first it really is the very first bit as the address is read through the Ethernet.

			To see the MAC addresses of the machines on your subnet:
			arp -a


			== MAC address spoofing ==

			[http://slagheap.net/etherspoof/ MacOSX]

			[http://www.klcconsulting.net/Change_MAC_w98.htm Win98]

			[http://www.bsdatwork.com/2004/06/19/mac_spoofing_on_freebsd/ FreeBSD using netgraph]

			[http://whoozoo.co.uk/mac-spoof-linux.htm Linux]

Pbug at 23:03, 3 December 2005

2005-12-03T23:03:53Z

← Older revision		Revision as of 16:03, 3 December 2005
Line 1:		Line 1:
	MAC stands for Media Access Control. An [[Ethernet]] card has a MAC address to identify it. This is a 48 bit number which makes the address space larger than the Internet's address space. The first 24 bits are registered with the IEEE, and thus you can identify what Ethernet card maker is by its address (and possibly what model of card as well).		MAC stands for Media Access Control. An [[Ethernet]] card has a MAC address to identify it which is identified in the [[OSI]] layer 2 frame that it outputs to speak on the [[LAN]]. This is a 48 bit number which makes the address space larger than the Internet's address space. The first 24 bits are registered with the IEEE, and thus you can identify what Ethernet card maker is by its address (and possibly what model of card as well).

	[http://standards.ieee.org/regauth/oui/oui.txt OUI File of MAC Addresses]		[http://standards.ieee.org/regauth/oui/oui.txt OUI File of MAC Addresses]

			A MAC address with all bits sets (also known as FF:FF:FF:FF:FF:FF) is a special address and means that it is a [[broadcast]] (all stations on a LAN are addressed). A MAC address where the first bit is set indicates that this address is a [[multicast]] address. Since the bitorder of Ethernet is [[little endian\|little-endian]] meaning the least significant bit is first it really is the very first bit as the address is read through the Ethernet.

Pbug at 22:33, 3 December 2005

2005-12-03T22:33:32Z

← Older revision		Revision as of 15:33, 3 December 2005
Line 1:		Line 1:
	MAC stands for Media Access Control. An [[Ethernet]] card has a MAC address to identify it. This is a 48 bit number which makes the address space larger than the Internet's address space. The first 24 bits are registered with the IEEE, and thus you can identify what Ethernet card ~~model~~ is by its address.		MAC stands for Media Access Control. An [[Ethernet]] card has a MAC address to identify it. This is a 48 bit number which makes the address space larger than the Internet's address space. The first 24 bits are registered with the IEEE, and thus you can identify what Ethernet card maker is by its address (and possibly what model of card as well).

	[http://standards.ieee.org/regauth/oui/oui.txt OUI File of MAC Addresses]		[http://standards.ieee.org/regauth/oui/oui.txt OUI File of MAC Addresses]

Pbug at 22:32, 3 December 2005

2005-12-03T22:32:38Z

New page

MAC stands for Media Access Control. An [[Ethernet]] card has a MAC address to identify it. This is a 48 bit number which makes the address space larger than the Internet's address space. The first 24 bits are registered with the IEEE, and thus you can identify what Ethernet card model is by its address.

[http://standards.ieee.org/regauth/oui/oui.txt OUI File of MAC Addresses]