Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm told that an interface can transmit a frame no matter what the OS has set for the interface's MAC. I'm also under the impression this is how VMs do host-bridging. If that is so, then what uses the interfaces bound MAC address?

Specifically, I'm asking about the software MAC not the MAcs that were burned into the ROM in the 70s:

wlan0     Link encap:Ethernet  HWaddr 00:16:ce:01:

That is a line of output from ifconfig, but I'm told the interface wlan0 can transmit under /any/ MAC address, and that MAC I'm seeing does nothing at all (except maybe provide a default for some libraries). I'm told that with a VM's host-bridging it will exploit that, and transmit on an arbitrary amount of ip address - but that it doesn't stop there the AP will actually permit you to assign a unique IP to each one of those VMs, because the AP will receive the requests on different MACs.

  1. Do you have any special permissions (linux) to craft a packet from a "virtual" MAC address.
  2. If a MAC address is how a router tracks what interface, and host, has whatever IP, then how do you stop one host from request all of the IPs to virtual interfaces
  3. How do you stop users from using virtual MAC addresses
  4. Does this require a special option in the kernel or piece to built in the network stack?
share|improve this question

2 Answers 2

up vote 4 down vote accepted

MAC addresses are organized and standardized by the IEEE. Every device that connects to an ethernet network has a unique MAC address that is assigned to it, this way any two devices can be on the same network and communicate without problems. This doesn't mean that the OS can't choose what MAC address to use though, like for monitoring or spoofing traffic. Plenty to read here

In response to questions below

  1. With root permissions you are able to do what ever you want (basically). There are two ways to send a packet with a custom MAC: First, Changing the MAC address on the interface with the ifconfig command, this will affect all traffic system wide; Second, forming the packets yourself and writing them directly to the interface with specialized code. For instance, nmap uses this method when you tell it to scan ports with a different source MAC address.
  2. (and 3) You don't. If a malicious host was on your network and decided to hijack MAC addresses you could have a serious problem. This is one reason why securing your LAN and having tight access control policies are important. At my company, our desktop LAN switches are configured such that each port learns the MAC address of the computer that is connected to it and if that address changes the port is shutdown, also all ports that aren't in use are shutdown. This policy was implemented after a night security officer tried to plug in his laptop which was configured with a static IP the same as one of our servers and caused a lot of problems. By limiting each port to one MAC address we are now able to prevent(mostly) this from happening. Only if someone knew to change their MAC to the address of the computer that is already plugged in would they be able to get on our network, this is highly unlikely. Also, with regards to requesting all IPs to all MACs, your switch is constantly updating its MAC table so as soon as the valid host sends a new packet the table will update with the correct port. If the malicious person was constantly poisoning the network with malformed packets though there would be very little you could do.
share|improve this answer
    
This is what I thought, but I understand this to be wrong. I'm told if the OS has 5 VMs they can all have their "own" MAC and have it bridged through, thus exposing 5 unique MACs for a single "device" –  Evan Carroll Jan 27 '10 at 4:03
    
Yes, technically a device can send frames with any MAC address that it wants, the point is that the pre assigned addresses exist to avoid conflicts. But yes, a VM does create "virtual" addresses to use on the network, I'm not sure how it picks them but I would guess that they are from a range that are unlikely to be on your network. –  einstiien Jan 27 '10 at 4:49
    
I think this answer is a good start, but it could be made a little better. (1) Do you have any special permissions (linux) to craft a packet from a "virtual" MAC address., (2) If a MAC address is how a router tracks what interface, and host, has whatever IP, then how do you stop one host from request all of the IPs to virtual interfaces, (3) how do you stop users from using virtual MAC addresses –  Evan Carroll Jan 27 '10 at 7:03
    
see my edits above. –  einstiien Jan 27 '10 at 8:05

The MAC address "burn" in the EEPROM is just a default. The network driver can be configured to use a different one. It is possible to rewrite the EEPROM with a different MAC address.

share|improve this answer
    
I'll update the question apparently I wasn't clear, sorry =( –  Evan Carroll Jan 27 '10 at 3:06
    
all packets exiting via that interface will use the default "burned" MAC address unless: it is configured differently in the driver; the interface is part of a bridge. If the interface is part of a bridge, the source MAC will be the original source of the frame, if the frame is just passing. If the frame is generated by the host will have the source MAC one of the MAC of the interfaces part of the bridge, or a MAC configured manualy. –  Mircea Vutcovici Jan 27 '10 at 3:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.