1

I'm trying to use tcprewrite to change the source MAC address of some packets. I deliberately chose the prefix AB:CD:EF that does not belong to any hardware manufacturer so that I can distinguish such packets from other real packets. The packets are played to a server via a Cisco switch.

I realized that my server can't capture any packets with the MAC prefix AB:CD:EF, but when I changed the prefix to 00:00:08, which belongs to Xerox, these packets can be captured.

Is this because the switch can tell that the AB:CD:EF MAC prefix is not valid and drops the packets?

Improve this question

2 Answers 2

Reset to default
2

0xAB is 10101011. Those last two bits signify locally-administered and multicast.

I expect that, and a poisoned ARP-cache, cause the symptoms you see.

See Wikipedia

If the least significant bit of the most significant address octet is set to 1, the frame will still be sent only once; however, NICs will choose to accept it based on different criteria than a matching MAC address: for example, based on a configurable list of accepted multicast MAC addresses. This is called multicast addressing.

The IEEE has assigned AC-DE-48 to “PRIVATE”. They use that as an example value in some of their documents.

Improve this answer
0
0

Most likely because there's no Ethernet interface with such MAC address. Try changing your MAC address to that and see what happens.

Improve this answer
2
  • I have tried that. Packets with the AB:CD:EF prefix aren't captured, but packets with the 00:00:08 prefix are. Is the switch intelligent enough to recognize invalid MAC prefixes?
    – Rayne
    Oct 19, 2011 at 9:01
  • 1
    That cannot be the issue because what if that prefix goes valid on the future? The switch would be useless. Check RedGrittyBrick's answer.
    – m0skit0
    Oct 19, 2011 at 9:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .