up vote 0 down vote favorite
share [g+] share [fb]

I'm trying to use tcprewrite to change the source MAC address of some packets. I deliberately chose the prefix AB:CD:EF that does not belong to any hardware manufacturer so that I can distinguish such packets from other real packets. The packets are played to a server via a Cisco switch.

I realized that my server can't capture any packets with the MAC prefix AB:CD:EF, but when I changed the prefix to 00:00:08, which belongs to Xerox, these packets can be captured.

Is this because the switch can tell that the AB:CD:EF MAC prefix is not valid and drops the packets?

Thank you!

link|improve this question
67% accept rate
feedback

2 Answers

up vote 2 down vote accepted

0xAB is 10101011. Those last two bits signify locally-administered and multicast.

I expect that, and a poisoned ARP-cache, cause the symptoms you see.

See Wikipedia

If the least significant bit of the most significant address octet is set to 1, the frame will still be sent only once; however, NICs will choose to accept it based on different criteria than a matching MAC address: for example, based on a configurable list of accepted multicast MAC addresses. This is called multicast addressing.

The IEEE has assigned AC-DE-48 to “PRIVATE”. They use that as an example value in some of their documents.

link|improve this answer
Thanks! Using the Private MAC works now. – Rayne Oct 20 '11 at 6:19
feedback
up vote 0 down vote

Most likely because there's no Ethernet interface with such MAC address. Try changing your MAC address to that and see what happens.

link|improve this answer
I have tried that. Packets with the AB:CD:EF prefix aren't captured, but packets with the 00:00:08 prefix are. Is the switch intelligent enough to recognize invalid MAC prefixes? – Rayne Oct 19 '11 at 9:01
1  
That cannot be the issue because what if that prefix goes valid on the future? The switch would be useless. Check RedGrittyBrick's answer. – m0skit0 Oct 19 '11 at 9:45
Thank you! His answer was what I was looking for. – Rayne Oct 20 '11 at 6:20
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.