1

Last weeks I was performing some ARP spoof tests on my own network and I realized that if I tried spoofing my MAC address in the Ethernet Header. (for one packet only, I connected with a different MAC) that my messages didn't arrive on the destination anymore.

Since I was doing this on a WPA2 wireless connection, I had the impression that every connection on WPA2 gets mapped to a MAC address and that all other source MAC addresses are blocked.

Is this true? And if it is not, what else could it be that makes my packet not arrive? (I also monitored at the target end, and with my real MAC it received the package, with with a spoofed MAC it didn't.

It would be nice if someone had some references too!

Improve this question
1

Remember 802.11 is not Ethernet, so the same rules don't apply.
If you spoof your source address, the AP considers you an unknown client-- one that hasn't associated with the AP yet, so it ignores you.

Improve this answer
5
  • Thanks for this! So I guess I can say that AP's holds a list of all Associated Clients and their MAC? Does this mean that AP's also check the Ethernet Header, and not only the 802.11 Headers? So for example: If I'd send a 802.11 Header with my original MAC, and an Ethernet Header with a wrong check, this would be filtered? – Christian Veenman Jan 15 '16 at 12:29
  • 1
    There is no Ethernet header. Your laptop is using 802.11 as the L2 protocol, not Ethernet. – Ron Trunk Jan 15 '16 at 13:37
  • Ah! I am a bit new to this, but I guess when a 802.11 packet is send to a node on a Wired Ethernet Network, the 802.11 MAC Header is transformed into an Ethernet Header? – Christian Veenman Jan 15 '16 at 14:02
  • Replaced, not transformed. – Ron Trunk Jan 15 '16 at 14:02
  • Alright thanks a lot, for your time and help! – Christian Veenman Jan 15 '16 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.