1

I have a small network i use to redistribute internet. Now from what i kniw , routers usually map a network depending on which port its connected to. They work at Layer 3. We have been having an issue whereby we found most of our packets were being dropped...we solved it, it was a faulty switch, Long story short. A colleague has tried suggesting that someone using a software i.e connectify ,was using our gateway address 10.0.0.1 as a static ip therefore creating chaos. We saw the ip logged in the hotspot software we use. Now i dont think this is possible. But can that confuse a switch. if it stores two Mac addresses that point to the same place?

3

It is not possible for a switch to have a MAC address assigned to more than 1 port. When a MAC address is seen on a new port the switch simply updates its records to show the MAC is on the new port, overriding the old entry. Loops can cause the switch to do this at an excessive rate and is called a mac address flap. Usually switches will log mac address flaps to the buffer/console.

If I understand you correctly then you are saying that your default gateway address is 10.0.0.1 and someone else also assigned their computer 10.0.0.1. That wouldn't confuse a switch as a switch doesn't care what IP you have, a switch works at layer 2 and deals exclusively with MAC addresses. What is more likely is that due to the duplicate IP address, some of your clients were ARPing for 10.0.0.1 and receiving the real routers MAC address and some were receiving the 10.0.0.1 clone MAC address and sending traffic there instead of the router. Any traffic going to the clone would have been dropped. Any traffic going to the router would have been forwarded (assuming its configured correctly). This could give the impression that the switch or router is dropping packets but in reality the switch is just forwarding the traffic to the destination MAC address that the clients requested.

  • Thank You. So now, This means that nevertheless some packets are getting lost when they are fowarded to the clone gateway? This mean that someone can just mess up my network by using a static IP? since some clients will be getting inconvineinced when the packets are fowarded to the clone? what to do then? How would you advice i stop this guy? MAC Address filtering? – Ndeto Jul 25 '16 at 8:54
  • Use dynamic arp inspection. Its designed to prevent this exact scenario. What you may not realise is that by pretending to the gateway any traffic sent to the clone can be captured and inspected. Any unsecured traffic containing sensitive info can be read by the "man in the middle." Note that to use DAI, you may need to turn on DHCP snooping. These are features on most managed switches. – Mark Jul 25 '16 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.