30

I was reading an article on WEP cracking, which said that filtering MAC addresses was not enough, since there are tools to change what the computer reports as its MAC address.

This made me wonder what would happen if someone uses the same MAC address as another computer on the network?

I've looked on Google, but most websites just say something like "strange things could happen". What kind of things? Packet loss, disconnected users?

4
  • 1
    The tag for wifi didn't really apply because this question applies to computer networks in general. I think you'll get better results with the networking tag.
    – Travis
    Aug 3, 2009 at 17:29
  • Thanks, I didn't think that the question could be so generic.
    – Manu
    Aug 4, 2009 at 11:23
  • Its only generic in the sense that something like a MAC address can cause so much havoc. Some routers fare better at handling these things, but the MAC address ideally supposed to be a fundamental piece of the TCP/IP stack that it is somewhat assumed that it doesn't change or collide.
    – Dillie-O
    Aug 4, 2009 at 15:08
  • Shameless plug to an answer to the same question
    – Hennes
    Feb 3, 2015 at 17:41

4 Answers 4

25

It really does depend on how the routers and systems on the network are configured.

At our office, our machines will not connect to the local domain due to the collision in MAC addresses. You'll get a notification message (in Windows) saying there is already a system with the Id on the network.

Sometimes you get into "races" where each computer attempts to register itself with the router, and any traffic coming to the machine can get lost since packet A will go to your machine, the other machine will register, so packet B will go there. Things can start bouncing back and forth.

You can start seeing unreachable host errors due to the collisions as well.

The results really do vary depending on when the duplicate machine is coming online and how the current infrastructure is setup to handle such items.

Your network admin will have more detailed answers on this.

1
  • 8
    +1 - it really depends on the devices that are dealing with the MACs. Aug 3, 2009 at 17:04
15

Basically the expected behavior is "undefined".

Basically the two network cards would both present all packets sent to that address to their respective machines which will cause some confusion when both are active. I suspect that neither machine would be able to effectively communicate with the network while the other were active.

4

I tried this by setting same MAC address in two machines by using 'cloned MAC'. Both the machines were running on Ubuntu 14.04 x64.

Both the computers were connected to internet over same router. But at a time only one computer was able to transmit or receive data.

When both machines try to transmit or receive data at same time, none of them could complete the transmission.

Of course, this behavior is specific to my setup. On different router and devices behaviour will be different.

4

@Dillie-O's answer is the correct generic answer, that is, if all the machines involved have no idea about the duplicate MAC addresses. However, the case you asked about is an exception. If another machine which has the duplicate MAC address knows that it has a duplicate address and crafts packets properly, they can basically use the MAC address carefully and stay under the radar. The other machine typically drops the packets the "shadow" machine (one that has picked the duplicate MAC address) is communicating with since it has no prior knowledge about it. Note that in all this, the MAC and TCP/IP stack of the shadow machine are not behaving as usual and are aware of the fact that they are shadowing someone else. Also, the shadow cannot really do exactly what the victim does without being undetected. Note that since WEP maintains the broadcast nature of the LAN - i.e. everyone can potentially see other hosts packets. In a switched environment, the behavior depends on how the switch responds to seeing same MACs at two ports.

To give you a more concrete example, let's have a look at DHCP. If the victim is already active, the shadow will not need a new IP address and will use the IP address assigned to the victim, so no "registering with the router" is needed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .