2

Recently the Wifi network at our small company was messed up in a strange way. When I did a

     arp -i en1 -a

I did in fact see the same MAC address listed twice. When I inquired with a non-technical person (the tech was indisposed), I was told the network was "messed up" and wait a few hours.

The MAC that was listed twice was for a "Motorola Mobility LLC" device and it was 10.100.100.1 and 10.100.100.130. In the past 10.100.100.1 was a Cisco device.

I tried doing a ping and got back something very strange:

    Darkstar:~ username$ curl http://abc12345.org

    invalid requestDarkstar:~ username$
    Darkstar:~ username$ ping abc12345.org
    PING abc12345.org (173.246.99.7): 56 data bytes
    64 bytes from 173.246.99.7: icmp_seq=0 ttl=44 time=102.034 ms
    92 bytes from 10.100.100.130: Redirect Host(New addr: 10.100.100.1)
    Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
     4  5  00 0054 d9af   0 0000  3f  01 221b 10.100.100.125  173.246.99.7

    64 bytes from 173.246.99.7: icmp_seq=1 ttl=44 time=123.127 ms
    92 bytes from 10.100.100.130: Redirect Host(New addr: 10.100.100.1)
    Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
     4  5  00 0054 d5b3   0 0000  3f  01 2617 10.100.100.125  173.246.99.7

    64 bytes from 173.246.99.7: icmp_seq=2 ttl=44 time=98.782 ms
    92 bytes from 10.100.100.130: Redirect Host(New addr: 10.100.100.1)
    Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
     4  5  00 0054 c095   0 0000  3f  01 3b35 10.100.100.125  173.246.99.7

    64 bytes from 173.246.99.7: icmp_seq=3 ttl=44 time=106.846 ms
    92 bytes from 10.100.100.130: Redirect Host(New addr: 10.100.100.1)
    Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
     4  5  00 0054 7de4   0 0000  3f  01 7de6 10.100.100.125  173.246.99.7

    64 bytes from 173.246.99.7: icmp_seq=4 ttl=44 time=105.608 ms
    ^C
    --- abc12345.org ping statistics ---

My first question is, is the .130 device on the network having all traffic somehow magically sent through it? The second question is what is the meaning of the "Redirect Host" activity during the ping? The 3rd question is, how can one MAC appear twice in the ARP table?

This network was, I thought, a simple Wifi router going to a cable connection of some type.

3
  • Ok. What's your question?
    – Polynomial
    Oct 16, 2013 at 15:27
  • 1
    first guess: Someone munually set their MAC address to match the existing gateway to intercept all data and your FreeBSd host was the only one to mention that in pings ?
    – Hennes
    Dec 16, 2015 at 13:32
  • 1
    Somebody is ARP spoofing, and that causes big problems. Either a disgruntled, or stupid, employee is causing a DoS.
    – Ron Maupin
    Feb 19, 2016 at 17:45

1 Answer 1

1

Having the same MAC address appear several times is not necessarily a problem. The mapping is one-way: from IP address to MAC address. The ARP table is the way through which the OS knows the MAC address which should be used to send a packet to a machine with a given IP address. If a given machine assumes several IP addresses simultaneously (or in close succession), all with the same hardware interface, then you will get several entries with the same MAC. While this is supported and not, in itself, a problem, this might indicate something fishy in your case.

The "redirect host" messages are traces of ICMP Redirect packets. Namely, a machine claiming to have IP address 10.100.100.130 is reacting to your "ping" request, and tells to your machine "hey you, 10.100.100.125, when you want to talk to 173.246.99.7, you should send the packet to router 10.100.100.1". Presumably, your machine sent the request to another gateway address, which worked (since the target host responded). Use netstat -rn to display your current routing table.

These messages seem to indicate that you have two routers on the local network. This is unusual. There again, this is not a lethal issue (the Internet was designed to be redundant with several paths from any two points) but may indicate some configuration problem, or possibly an ongoing (and inexpert) attack attempt (one of the other systems trying to redirect the traffic of the other hosts to itself).

1
  • I should qualify to say that the two IPs that had the same MAC were 10.100.100.130 and 10.100.100.1.
    – Friendly
    Oct 16, 2013 at 17:25

You must log in to answer this question.