23

It's possible for two hosts to have the same MAC, due to spoofing, a mistake during manufacturing, or willful negligence on the part of the manufacturer. So, 1) In general, an Ethernet switch keeps a table of which MAC addresses are attached to which ports. It bases this table on the source address of frames it receives during the normal operation of the ...


17

This example in particular (58-2C-80-13-92-63) is a USB Ethernet chip made by Huawei. Looks like they're being lazy and reusing the MAC. Examples from Google: [50413.229125] cdc_ether 2-1:1.0: eth1: register 'cdc_ether' at usb-0000:00:1d.7-1, CDC Ethernet Device, 58:2c:80:13:92:63 … [ 122.660069] huawei_cdc_ncm 3-3:1.1 wwan0: register 'huawei_cdc_ncm' at ...


15

A MAC address conflict is what's happening. Since you have two objects with the same MAC address, packets bound for either device will end up at one or the other, and where you "intend" for them to go doesn't matter a whole lot. Don't assign the same MAC address to your "COMP" as you have for your VMWare server. MAC addresses should be unique, when you ...


15

I had to "fix" the same situation in one of our production plants about 6 years ago. I got to tell the production engineers that they were idiots :-). In their defense: This was the first networking product ever and R&D hadn't exactly thought the production ramifications through. There was no way around it then (and still isn't now). Each device ...


13

Using nmap a lot of info can be found.. nmap -A -v -v 192.168.1.0/24 gives a lot of information, even SO in some cases nmap -sn 192.168.1.0/24 gives the MAC and IP addresses. Very Useful too sudo nmap -PU 192.168.1.0/24 explains every IP address


12

If your NICs have the same MAC addresses, you should stop fiddling around with workarounds and return them to the manufacturer as defective. Get proper replacements and continue on as normal. Incur the downtime once instead of the recurring issues that will pop up from continuing to hack together a "solution."


11

To address your most recent content update, if you want to "pass" the physical NIC through to the guest. This article describes it for ESXi 4 and this article walks you through it for ESXi 5. You use DirectPath I/O to present the physical NIC directly to the guest. When you do this, the host will not use that NIC at all. The way you're trying to do it now ...


10

You're an idiot, don't connect things with the same MAC to the same network. ;-) Seriously, a MAC address is absolutely fundamental to the way that the IEEE 802.3 networks work. With multiple devices on the same physical bit of Ethernet cable with the same MAC, each receiver will respond with a "that's me" when an ARP packet flies by. So, you have to ...


10

You don't prevent MAC spoofing, since it's entirely client-side. This is the reason that no one that really cares about security is using MAC whitelisting or blacklisting. If you care about controlling what devices connect to your network, you should be using 802.1x with device certificates issued by your own internal CA that you control, or with some form ...


10

When a switch has the ability to learn what MAC addresses each of its ports serves, then uses that to determine which port to send ethernet packets out, what is that feature called? That's called. Wait for it...switching. All switches do that, and it's a key differentiator between hubs and switches. Also, does every switch with that feature also ...


8

The following command with nmap with root privilegies (or using sudo): sudo nmap -sP 172.31.201.0/24 | awk '/Nmap scan report for/{printf $5;}/MAC Address:/{print " => "$3;}' | sort results in: 172.31.201.80 => 00:50:56:AF:56:FB 172.31.201.97 => 00:26:73:78:51:42 server1.company.internal.local => 3C:D9:2B:70:BC:99 ...


8

This is as it should be. eth0 is the physical interface, vmbr0 is the bridge that KVM creates for the guests. Since it is attached to eth0, it has eth0's MAC address. Extra: Since you're using bridged networking, simply give your first guest machine the second public IP. It should just work.


8

"You're an idiot, don't connect things with the same MAC to the same network" (you said that'd be ok) :) The correct answer to your problem is to fix the manufacturing process to assign different MAC addresses on the devices, either sequentially or however (date mfg'd then a unique #, etc.)


7

Answers to your question: YES it is possible, and NO you'll not have consistent contact. You might...the administrator might see the problem and disable the ports on the switch. What I encountered was with two systems with the same MAC address connected to the same switch, and what I noticed was that networking would work with the LAST system to send out ...


7

You can't change a static entry to dynamic. Just delete the static entry and the switch will add its own dynamic entry when that host sends a frame. Use the "no" syntax to delete an address. E.g.: no mac-address-table static 12ab.47dd.ff89 vlan 3


7

This commands scans all IP addresses in a range and shows the MAC address of each IP address. It does this in a greppable format, or in other words; displays IP and MAC address on a single line. Thats handy if you want to export to Excel or run a grep on it. nmap -n -sP 10.0.3.0/24 | awk '/Nmap scan report/{printf $5;printf " ";getline;getline;print $3;}' ...


7

Iptables has a mac module. You can use it like this: /sbin/iptables -A INPUT -m mac --mac-source 00:0F:EA:91:04:08 -j DROP nixCraft has an extensive guide on how to create filter rules based on mac addresses. But this only works on the same network, as MAC addressing is link-layer specific and won't get forwarded when using routing. So, as long as the ...


7

You can't do this because MAC addresses aren't available to you for connections that have traversed the internet. To do what you want it would be much safer to setup a VPN and only allow connections via that to your critical infrastructure. If you can't do that then you could try setting up some sort of two factor authentication. If you really are stuck ...


7

Fire your manufacturer. I'm serious. This isn't even an amateur hour mistake, this is dangerous levels of utter incompetence. It's like a bank discovering that the company that prints the physical bills delivered several million bills all with the same sequence number, or a car manufacturer learning that the latest batch of license plates all had the same ...


7

It's impossible to prevent a MAC-spoofing attack on a completely open Wi-Fi network. However, it's relatively easy to detect the attack: Both the attacker and the victim whose MAC address is being spoofed will have trouble using the network, as each computer will send TCP resets for connections the other has initiated. Thus the person whose MAC address was ...


6

These variants work as well. longer: openssl rand -hex 6 | sed 's/\(..\)\(..\)\(..\)\(..\)\(..\)\(..\)/\1:\2:\3:\4:\5:\6/' or shorter: openssl rand -hex 6 | sed 's/\(..\)/\1:/g; s/:$//' The load consumption of both variants is very similar according to quick measuring with time.


6

Thanks to a nice sock in chat, I found the answer to this after I'd already typed up the question. The painfully obvious answer is show interfaces. Good ol' shint. Hopless-WAP#sh int [...] Dot11Radio0 is up, line protocol is up Hardware is 802.11G Radio, address is feed.face.beef (bia beef.face.feed) MTU 1500 bytes, BW 54000 Kbit, ...


6

Switches don't know what ARP messages are and don't care about ARP. ARP is not a layer two protocol because it maps IP addresses and switches operate purely at layer 2 (Ethernet). As far as the switch is concerned, an ARP message is a packet like any other packet and they handle it the same way. If they didn't update the CAM table on unicast ARP messages, ...


6

Rather than tell you you're an idiot--even though you said it's okay--I'd rather tell you why you shouldn't put things with the same MAC on the same network. SystemA wants to talk to SystemB. SystemA gets SystemB's IP address and tries to determine a route between the two of them. If SystemA and SystemB are on the same network, SystemA needs SystemB's ...


6

You are right that one device has one MAC address. Your wireless card is considered one device. Your Ethernet card is considered one device. Every Network Interface Card (NIC) is one device and has its own MAC address.


5

The book is correct, however there are pieces it left out. MAC addresses are not as fixed as you would think, most higher end NICs have the ability to change the MAC address to something specific. Either in the NIC's BIOS or in the driver itself. There are specific ranges of MAC address set aside for 'virtual' systems (see What range of MAC addresses can I ...


5

It seems Virtualbox version 5 uses locally administered addresses beginning with 0A-00-27 ( while in previous versions it was using 08-00-27 ). By the way when assigning MAC addresses manually just keep in mind that 00-03-FF is used by Virtual-PC VMs like mentioned here: http://blogs.technet.com/b/medv/archive/2011/01/24/how-to-manage-vm-mac-addresses-with-...


5

The behavior is both expected and normal, because of ARP.


5

The term "smart switch" that you're using isn't a standard term. I think you mean "switch that supports VLANs" when you say "smart switch". Switches maintain layer 2 adjacency tables. These tables identify physical port and MAC address associations and allow the switch to direct traffic only to the intended destination. These aren't actually "ARP tables"-- ...


5

Of course they have MAC addresses, but that won't help you since you obviously can't block based on them. Remember that MAC addresses are only visible and relevant on the directly connected link.


Only top voted, non community-wiki answers of a minimum length are eligible