Recently the Wifi network at our small company was messed up in a strange way. When I did a

     arp -i en1 -a

I did in fact see the same MAC address listed twice. When I inquired with a non-technical person (the tech was indisposed), I was told the network was "messed up" and wait a few hours.

The MAC that was listed twice was for a "Motorola Mobility LLC" device and it was and In the past was a Cisco device.

I tried doing a ping and got back something very strange:

    Darkstar:~ username$ curl http://abc12345.org

    invalid requestDarkstar:~ username$
    Darkstar:~ username$ ping abc12345.org
    PING abc12345.org ( 56 data bytes
    64 bytes from icmp_seq=0 ttl=44 time=102.034 ms
    92 bytes from Redirect Host(New addr:
    Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
     4  5  00 0054 d9af   0 0000  3f  01 221b

    64 bytes from icmp_seq=1 ttl=44 time=123.127 ms
    92 bytes from Redirect Host(New addr:
    Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
     4  5  00 0054 d5b3   0 0000  3f  01 2617

    64 bytes from icmp_seq=2 ttl=44 time=98.782 ms
    92 bytes from Redirect Host(New addr:
    Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
     4  5  00 0054 c095   0 0000  3f  01 3b35

    64 bytes from icmp_seq=3 ttl=44 time=106.846 ms
    92 bytes from Redirect Host(New addr:
    Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
     4  5  00 0054 7de4   0 0000  3f  01 7de6

    64 bytes from icmp_seq=4 ttl=44 time=105.608 ms
    --- abc12345.org ping statistics ---

My first question is, is the .130 device on the network having all traffic somehow magically sent through it? The second question is what is the meaning of the "Redirect Host" activity during the ping? The 3rd question is, how can one MAC appear twice in the ARP table?

This network was, I thought, a simple Wifi router going to a cable connection of some type.

migrated from security.stackexchange.com Oct 16 '13 at 21:44

This question came from our site for information security professionals.

  • Ok. What's your question? – Polynomial Oct 16 '13 at 15:27
  • 1
    first guess: Someone munually set their MAC address to match the existing gateway to intercept all data and your FreeBSd host was the only one to mention that in pings ? – Hennes Dec 16 '15 at 13:32
  • 1
    Somebody is ARP spoofing, and that causes big problems. Either a disgruntled, or stupid, employee is causing a DoS. – Ron Maupin Feb 19 '16 at 17:45

Having the same MAC address appear several times is not necessarily a problem. The mapping is one-way: from IP address to MAC address. The ARP table is the way through which the OS knows the MAC address which should be used to send a packet to a machine with a given IP address. If a given machine assumes several IP addresses simultaneously (or in close succession), all with the same hardware interface, then you will get several entries with the same MAC. While this is supported and not, in itself, a problem, this might indicate something fishy in your case.

The "redirect host" messages are traces of ICMP Redirect packets. Namely, a machine claiming to have IP address is reacting to your "ping" request, and tells to your machine "hey you,, when you want to talk to, you should send the packet to router". Presumably, your machine sent the request to another gateway address, which worked (since the target host responded). Use netstat -rn to display your current routing table.

These messages seem to indicate that you have two routers on the local network. This is unusual. There again, this is not a lethal issue (the Internet was designed to be redundant with several paths from any two points) but may indicate some configuration problem, or possibly an ongoing (and inexpert) attack attempt (one of the other systems trying to redirect the traffic of the other hosts to itself).

  • I should qualify to say that the two IPs that had the same MAC were and – Friendly Oct 16 '13 at 17:25

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.