2

I have two questions that both assume an attacker who has my MAC address:

  1. Suppose an attacker connects to the Internet before me, spoofing my MAC. I then connect and tell people to connect to my EUI-64 address. Will the attacker get my packets? Will the attacker be able to do illegal stuff pretending to be me?

  2. Suppose I connect first and then the attacker connects, spoofing my MAC. I am communicating with people using my EUI-64 address. Will the attacker be able to get my packets, if he gets himself assigned my EUI-64 address? Will the attacker be able to do illegal stuff pretending to be me?

I guess what I'm asking, is, EUI-64 depends on MAC addresses being unique. But since it's possible to spoof MACs, how can IPv6 address have any sort of uniqueness assumption at all? And if addresses aren't unique, how can routing possibly work?

  • Is the attacker in the same network (broadcast domain) as you? – rnxrx Dec 5 '16 at 16:00
  • @rnxrx Uh... Let's assume we're on different ISPs. So no? – Elliot Gorokhovsky Dec 5 '16 at 16:04
3

First, MAC addresses really have nothing to do with the Internet. MAC addresses are layer-2 addresses, only seen on a LAN. Layer-2 frames are stripped off at a router.

MAC address spoofing is more about LAN disruption than anything. LAN switches build MAC address tables in order to deliver a frame for a particular MAC address to the correct switch interface. A switch will modify its table every time a frame comes into the switch. What happens with MAC address spoofing is that the MAC address table will constantly be changing to the spoofed interface, then back to the real interface as each host sends traffic.

When an IPv6 address is assigned to a host, the host must see if that address is already used on the LAN. If the address is already used, the host must pick a different address. In reality, most OSes use Privacy Extensions or Random Addressing, so SLAAC with EUI-64 addressing is pretty rare. In any case, a host trying to spoof your IPv6 (layer-3) address would need to be on your network because the network portion of the address would be different if that host is on a different network. Traffic destined to your network will not be sent to a different network.


Edit for your comment about different ISPs:

You seem to be confusing layer-2 and layer-3 addresses. The host portion of a layer-3 address can be the same on any other network. That is true for both IPv4 and IPv6. It is the network portion that must be unique on the Internet. You will have a unique network address, and any traffic destined to your network will only be sent to your network.

  • So "on your network" basically means "connected to the same LAN", right? Bevause if this held for WAN, then e.g. any Comcast customer could spoof any Comcast customer, right? – Elliot Gorokhovsky Dec 5 '16 at 16:08
  • Each Comcast customer will have a different network. The traffic destined to one customer's network will only be sent to that customer. – Ron Maupin Dec 5 '16 at 16:12
  • I get it. So for ipv4 Comcast gives u a single address, but for ipv6 they give you a subnet. What size is the subnet they give you? 64 bits? Is that what the /64 in my ifconfig ipv6 stuff means? I get 64 bits all to myself? That's awesome! – Elliot Gorokhovsky Dec 5 '16 at 16:16
  • Technically, an ISP should give every site a /48 network block, giving everyone 65,536 /64 networks. RFC 6177, IPv6 Address Assignment to End Sites has relaxed that, but most ISPs give their business customers a /48. ISPs will not advertise any prefixes longer than /48. – Ron Maupin Dec 5 '16 at 16:19
  • 1
    So... Everyone at my house has 64 bits to themselves? THATS SO AWESOME!!!!! I HAVE THE ENTIRE IPV4 INTERNET TO MYSELF, SQUARED!!! I AM A GOD!!! – Elliot Gorokhovsky Dec 5 '16 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.