2

I'm on a LAN provided by an ISP. My computer has its IP address, Subnet Mask, Default Gateway, DNS Servers(using DHCP).

I just wanted to see the MAC addresses of all the computers on my LAN.

  1. After applying subnet mask /18 or 255.255.192.0 on my IP I got: 182.3.64.0
  2. Which gives me 16384 IP addresses ranging from 182.3.64.0 to 182.3.127.255
  3. First and last IP addresses cannot be used as they are Network address and Broadcast address respectively.
  4. So, My subnet or local network contains 16382 hosts/computers. Right? In other words these 16382 hosts are behind single router.

I want to see the mac addresses of these hosts. SO, I pinged all of them and the picture shows the result:

enter image description here

My thinking:

I didn't understand why they all have same Mac Address. But now if I think little bit more about it. 16382 hosts behind a single router means too much of broadcast traffic (ARP broadcast). Which is not desirable. At the same time they cannot be connected to different routers because that would mean they are on different networks. May be they are on different VLAN (I don't know much about VLAN but I just know that it helps reducing the broadcast traffic).

I don't understand what is my problem. Kindly identify what am I getting wrong?

EDIT: The MAC address I'm receiving is the MAC of my default gateway.

4
  • Your ISP assigned you a /18 of public addresses? I didn't think that new blocks that large existed anymore for use within a single organization.
    – MDMarra
    Sep 2, 2013 at 1:23
  • @MDMarra: Yeah, I was also surprised. But they did.
    – claws
    Sep 2, 2013 at 1:27
  • 1
    Further reading: Proxy ARP en.wikipedia.org/wiki/Proxy_ARP
    – claws
    Sep 2, 2013 at 2:41
  • To know more after reading this answer. Search Bridged Networking - (Network Bridge Essentials) on youtube and watch it. First video explains the basics.
    – claws
    Sep 2, 2013 at 2:47

2 Answers 2

7

There could be a lot of things going on here.

In general, a subnet will not have as many nodes as it has possible node addresses. If there actually were enough hosts to fill an entire /18, you should be subnetting further, because the broadcast domain would in fact be too big.

However, I don't think this is actually what is going on. I suspect that there is some layer 2 bridging going on here, or possibly someone is MAC spoofing. A layer 2 bridge might respond to ARP with its own mac address for any IPs on the opposite side of the bridge, particularly if the interface on the other side of the bridge uses a different addressing scheme.

That said, scanning your upstream provider's subnets is generally something that should be avoided; it's often against the ToS and there is no valid operational reason for you to be doing it.

10
  • 4
    My guess is that the router/firewall is performing proxy ARP and that the MAC address in the question is the MAC address of the router/firewall.
    – joeqwerty
    Sep 2, 2013 at 1:31
  • 1
    The MAC address I'm receiving is the MAC of default gateway.
    – claws
    Sep 2, 2013 at 1:33
  • 1
    There you go, it's a bridge. It's probably replying to pretty much every IP address not on your side of it, and then doing its own thing on the other side of the bridge. Sep 2, 2013 at 1:35
  • 1
    @claws, here is how you would make a psuedo-bridge with proxy-arp on Linux. lartc.org/howto/lartc.bridging.proxy-arp.html
    – Zoredache
    Sep 2, 2013 at 2:15
  • 2
    Linux is a piece of software. Switches/bridges/routers/firewalls are functions provided by hardware+software in a particular configuration. Linux is an extremely versatile OS. It has, and can be used to provide all of those networking services, on the correct hardware. As for how to do it. That is what that document describes. But it does pre-suppose you know how networking works. I linked to a particular section in a howto. Read the entire thing. lartc.org
    – Zoredache
    Sep 2, 2013 at 3:17
2

If your network is composed of more than one subnet and you try to scan a subnet that you don't belong to, all the possible ip addresses (nodes) will show in the scan as if they all existed and all have the same mac address as your router.

I bet that the mac address in your console is the mac address of your router.

Here is a question I asked about how to get the mac addresses from a different subnet.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .