7 ms·

Hi, isn't Python now shipping with OSX? I haven't tested it, but wouldn't this also work while being more readable? (DISCLAIMER: I haven't tested it. Also, I ha

by column 12y ago

Hi, isn't Python now shipping with OSX? I haven't tested it, but wouldn't this also work while being more readable? (DISCLAIMER: I haven't tested it. Also, I haven't tested it.) from random import randint from os import getenv from subprocess import call from sys import argv if len(argv) > 1: # get network interface from cmdline parameter intf = argv[1] else: # get network interface from ENVIRONMENT variables intf = getenv('INTERFACE', '') if intf: # generate random mac address r = lambda: randint(0,255) randmac = '%02X:%02X:%02X:%02X:%02X:%02X' % (r(),r(),r(),r(),r(),r()) # change mac address call(["ifconfig", "%s hw ether %s" % (intf, randmac)]) else: print "Couldn't determine network interface"

lmb 12y ago
This code will lead to a nice, self-inflicted bug that will sometimes break your network connection. The low two bits of the first byte of the MAC have a special purpose and should be kept at 0 [1]. Learned this the hard way when developing on an embedded TCP stack. The switch silently discarded packets from multicast or local MAC addresses. [1] http://en.wikipedia.org/wiki/MAC_address#Address_details http://en.wikipedia.org/wiki/MAC_address#Address_details
- majke 12y ago
  You can use tricks based on multicast ethernet to detect interfaces in promiscuous mode: http://www.securityfriday.com/promiscuous_detection_01.pdf http://www.securityfriday.com/promiscuous_detection_01.pdf http://nmap.org/nsedoc/scripts/sniffer-detect.html http://nmap.org/nsedoc/scripts/sniffer-detect.html
  - lmb 12y ago
    That's pretty cool, thanks for the hint. The original PDF seems to be from 2001, does this still work?
- column 12y ago
  Thank you for pointing this out.
  - column 12y ago
    I found this link to be more easily understandable than Wikipedia : http://packetsdropped.wordpress.com/2011/01/13/mac-address-universally-or-locally-administered-bit-and-individualgroup-bit/ http://packetsdropped.wordpress.com/2011/01/13/mac-address-u...
grinich 12y ago
I feel like it should be outlawed to post untested code that must run as root. :/
- sneak 12y ago
  Please do not advocate for prior restraint, even jokingly.
  - pjlegato 12y ago
    Er. But you're advocating prior restraint of advocacy of prior restraint.
    - aliakbarkhan 12y ago
      Asking someone not to talk about something isn't the same thing as advocating that talking about something should be "outlawed".
- column 12y ago
  It's not like this is obfuscated code. I clearly mentioned this is untested, and it turns out it contains a major bug. But it starts a conversation, and made me learn about that significant bit in the mac address, should I pay a fine for starting a conversation?
easytiger 12y ago
that really should be a bash script, not a python one.
- column 12y ago
  why?
  - easytiger 12y ago
    Because mostly you are just shelling out. Also you can't just use any mac addr as some bits are reserved, e.g. multicast. But you can collapse that as so or suchlike: ifconfig eth34 hw ether $(openssl rand 6 | xxd -p | sed 's/$..$/\1:/g; s/:$//') Obviously doing this is wrong anyway but that will do what your script does.
    - column 12y ago
      To each his own, my point was readability, but some might prefer a one-liner such as yours.
      - easytiger 12y ago
        Well the whole point of scripting is to get the job done.
column 12y ago
Hi again, here is a version that corrects the bug addressed by lmb: from random import randint from random import choice from os import getenv from subprocess import call from sys import argv if len(argv) > 1: # get network interface from cmdline parameter intf = argv[1] else: # get network interface from ENVIRONMENT variables intf = getenv('INTERFACE', '') if intf: # generate random mac address r = lambda: randint(0,255) # Universally or Locally Administered Bit and Individual/Group Bit # See http://packetsdropped.wordpress.com/2011/01/13/ # mac-address-universally-or-locally-administered-bit-and-individualgroup-bit/ sbyte = choice(['%02X' % i for i in range(255) \ if bin(i)[-2] == '0' and \ bin(i)[-1] == '0']) randmac = sbyte + ':%02X:%02X:%02X:%02X:%02X' % (r(),r(),r(),r(),r()) # change mac address call(["ifconfig", "%s hw ether %s" % (intf, randmac)]) else: print "Couldn't determine network interface"

by column 12y ago

lmb 12y ago

This code will lead to a nice, self-inflicted bug that will sometimes break your network connection. The low two bits of the first byte of the MAC have a special purpose and should be kept at 0 [1]. Learned this the hard way when developing on an embedded TCP stack. The switch silently discarded packets from multicast or local MAC addresses. [1] http://en.wikipedia.org/wiki/MAC_address#Address_details http://en.wikipedia.org/wiki/MAC_address#Address_details

majke 12y ago
You can use tricks based on multicast ethernet to detect interfaces in promiscuous mode: http://www.securityfriday.com/promiscuous_detection_01.pdf http://www.securityfriday.com/promiscuous_detection_01.pdf http://nmap.org/nsedoc/scripts/sniffer-detect.html http://nmap.org/nsedoc/scripts/sniffer-detect.html
- lmb 12y ago
  That's pretty cool, thanks for the hint. The original PDF seems to be from 2001, does this still work?
column 12y ago
Thank you for pointing this out.
- column 12y ago
  I found this link to be more easily understandable than Wikipedia : http://packetsdropped.wordpress.com/2011/01/13/mac-address-universally-or-locally-administered-bit-and-individualgroup-bit/ http://packetsdropped.wordpress.com/2011/01/13/mac-address-u...

grinich 12y ago

I feel like it should be outlawed to post untested code that must run as root. :/

sneak 12y ago
Please do not advocate for prior restraint, even jokingly.
- pjlegato 12y ago
  Er. But you're advocating prior restraint of advocacy of prior restraint.
  - aliakbarkhan 12y ago
    Asking someone not to talk about something isn't the same thing as advocating that talking about something should be "outlawed".
column 12y ago
It's not like this is obfuscated code. I clearly mentioned this is untested, and it turns out it contains a major bug. But it starts a conversation, and made me learn about that significant bit in the mac address, should I pay a fine for starting a conversation?

easytiger 12y ago

that really should be a bash script, not a python one.

column 12y ago
why?
- easytiger 12y ago
  Because mostly you are just shelling out. Also you can't just use any mac addr as some bits are reserved, e.g. multicast. But you can collapse that as so or suchlike: ifconfig eth34 hw ether $(openssl rand 6 | xxd -p | sed 's/$..$/\1:/g; s/:$//') Obviously doing this is wrong anyway but that will do what your script does.
  - column 12y ago
    To each his own, my point was readability, but some might prefer a one-liner such as yours.
    - easytiger 12y ago
      Well the whole point of scripting is to get the job done.

column 12y ago

Hi again, here is a version that corrects the bug addressed by lmb: from random import randint from random import choice from os import getenv from subprocess import call from sys import argv if len(argv) > 1: # get network interface from cmdline parameter intf = argv[1] else: # get network interface from ENVIRONMENT variables intf = getenv('INTERFACE', '') if intf: # generate random mac address r = lambda: randint(0,255) # Universally or Locally Administered Bit and Individual/Group Bit # See http://packetsdropped.wordpress.com/2011/01/13/ # mac-address-universally-or-locally-administered-bit-and-individualgroup-bit/ sbyte = choice(['%02X' % i for i in range(255) \ if bin(i)[-2] == '0' and \ bin(i)[-1] == '0']) randmac = sbyte + ':%02X:%02X:%02X:%02X:%02X' % (r(),r(),r(),r(),r()) # change mac address call(["ifconfig", "%s hw ether %s" % (intf, randmac)]) else: print "Couldn't determine network interface"