1

I have programmed raw socket programs in C/C++ to initiate small tasks such as TCP/IP 3-way-handshakes, UDP, RTMP, etc. However I became curious about the next layer below IP and I was looking at an Ethernet header in Wireshark and noticed there is a source mac address. Obviously one appeal to raw sockets is IP spoofing. However even in raw sockets you do not have to specify an Ethernet header because the OS will handle that for you. So since it generates the source mac address can this source mac address be used to identify the sender in anyway?

Improve this question
1
  • MAC addresses can also be spoofed. Depending on the OS and hardware in use it may require access to the driver stack and may also be intrusive (interrupting connectivity while the driver reinitializes, etc) but by no means are hardware addresses inviolate.
    – rnxrx
    Dec 19, 2016 at 23:40

2 Answers 2

Reset to default
0

A MAC address, for protocols that use MAC addresses (not all do, and some are 48-bit and some are 64-bit), is local to the LAN on which the host with that address is.

A layer-3 device, e.g. a router, will strip off the layer-2 frames, including the source and destination MAC addresses, and discard them. The router will then route the layer-3 packets, based on the layer-3 addresses in the packets. When the router sends the packet to the next interface, it will create a new frame for the new interface, but it will do that without the information from the original layer-2 frame.

Obviously one appeal to raw sockets is IP spoofing.

That is certainly not an appeal, and, in many cases, illegal.

Improve this answer
1
  • Honestly I should have looked at the Ethernet header specification before coming here. And since I'm studying to be a pen-tester this is very much an appeal of raw sockets.
    – Arthur James
    Dec 19, 2016 at 23:44
0

If the receiver of the spoofed packet is "on-link" with the sender and suitable software is installed then the source MAC address could in principle be logged. In practice this is fairly unlikely.

If you want to construct the complete Ethernet packet (except the FCS) yourself you can use an "AF_PACKET" raw socket. This will let you control the source MAC address.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.