2

Could I have a server that spoof the same IP/MAC address of my server on the same L2 network that:

1 - does not do any conflict on the network.

2 - And on the same time when capturing packets on my server, I receive packets from that spoofer contains my IP and MAC, hence those packets seem to be generated from my server?

2

The duplicate MAC and IP address will create a conflict on the network. 2 nodes will reply to ARP requests for the MAC address, and 2 nodes will be capable of responding to communication directed at the IP address. The predominant symptom will be retransmissions which will degrade throughput.

It is unlikely the spoofing server will send traffic to itself, and if it did, it is unlikely its network interface would transmit them on the wire. Therefore, it is unlikely your server would see traffic from the spoofing server as your own.

2
  • Yeah, Good point Cliff ,, but is there is a method to disable the warning on the L2 switch?? – Anwar Ahdab Mar 1 '16 at 9:38
  • Disabling error warnings is dependent on the switch's software and the manufacturer's implementation. That aside, a duplicate MAC address is typically an error condition that warrants remediation. – Cliff Alligood Mar 5 '16 at 18:32
1

The short answer is, "No."

If you have the same MAC address on two hosts on the same layer-2 network, you will have problems. Switches learn the MAC address which is connected to each port as frames come into the ports, and they populate their MAC address table with this information. A switch will then send frames destined for that MAC address only to that one switch port from its MAC address table.

When you have the same MAC address on more than one port, the switch's MAC address table will constantly be changing, and some frames will be delivered to one port, and some frames will be delivered to the other ports. You will not duplicate the frames to multiple ports.

This is called MAC spoofing, and it is a common DoS attack on LANs to disrupt the LAN. This can be mitigated with LAN security features such as DHCP snooping an ARP inspection.

2
  • after some searches, I think this issue of duplicate MACs can be easily skipped "or spoofed if I can say that", especially with advanced and scripting enabled switches "like Extreme networks and Juniper" .. if this could be done, and when ruunning wireshark on my server interface, could my sever capture some packets from other "IP and MAC spoofer" and appears to be generated from my server?!!! – Anwar Ahdab Mar 6 '16 at 20:56
  • The problem is with how switches learn which MAC addresses are on which ports. As traffic comes into a switch port, a switch will create or update an entry in its MAC address table, show that this MAC address is on this port. When multiple devices have the same MAC address, the MAC address table will bounce between the ports. Traffic destined for that MAC address will be switched to the port in the MAC address table. The problem is that port will constantly change. MAC spoofing is about LAN disruption since it isn't very effective at intercepting traffic. – Ron Maupin Mar 6 '16 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.