4 ms·
This code will lead to a nice, self-inflicted bug that will sometimes break your network connection. The low two bits of the first byte of the MAC have a specia
by lmb 12y ago
This code will lead to a nice, self-inflicted bug that will sometimes break your network connection. The low two bits of the first byte of the MAC have a special purpose and should be kept at 0 [1]. Learned this the hard way when developing on an embedded TCP stack. The switch silently discarded packets from multicast or local MAC addresses.
[1] http://en.wikipedia.org/wiki/MAC_address#Address_details http://en.wikipedia.org/wiki/MAC_address#Address_details
- majke 12y agoYou can use tricks based on multicast ethernet to detect interfaces in promiscuous mode: http://www.securityfriday.com/promiscuous_detection_01.pdf http://www.securityfriday.com/promiscuous_detection_01.pdf http://nmap.org/nsedoc/scripts/sniffer-detect.html http://nmap.org/nsedoc/scripts/sniffer-detect.html
- lmb 12y agoThat's pretty cool, thanks for the hint. The original PDF seems to be from 2001, does this still work?
- column 12y agoThank you for pointing this out.
- column 12y agoI found this link to be more easily understandable than Wikipedia : http://packetsdropped.wordpress.com/2011/01/13/mac-address-universally-or-locally-administered-bit-and-individualgroup-bit/ http://packetsdropped.wordpress.com/2011/01/13/mac-address-u...