3

I want to do some very simple traffic analysis for a single device. I'm using tcpdump to collect this data. Is there an advantage to using a MAC address capture filter over a (static) IP address for the host? If so, what?

Improve this question

3 Answers 3

Reset to default
-1

If you are using static IP addreses there is not a single advantage of filtering by MAC because there is a one-to-one relationship among them, except if the device has a single interface and more than one IP address. In that case we're talking of a "one-to-many" relationship.

In DHCP environments it could happen that an IP address is used by a device now and by another later. In that case is useful to filter by MAC so you can follow the behavior of the same device despite of the IP adddress changing behavior.

Keep in mind that MAC addresses are local. IP packets coming from other LANs through a router, will have the original source MAC replaced with the router's MAC address.

Improve this answer
2
  • Static IP addresses aren't necessarily one-to-one: for example a server might have multiple IP addresses for very many reasons.
    – jonathanjo
    Oct 20, 2017 at 16:43
  • Yes, you're right. A server could have more than one IP address related to the same MAC address. i've modified the answer to explain that.
    – jcbermu
    Oct 23, 2017 at 8:04
4

Is there an advantage to using a MAC address capture filter over a (static) IP address for the host?

Depending on the purpose of the capture, certainly.

If so, what?

The advantage of capturing based on MAC address is that you are guaranteed to get all traffic sent or destined to the host.

If you only capture based on IP address, you will not get any non-IP based traffic such as ARP. This would also include any IPv6 traffic if you are capturing based on an IPv4 address.

If you are using an IPv6 address for your filter, you wouldn't get any IPv4 traffic and capturing based on IPv6 can be a bit more complicated as there is often a link-local address, a global address and multiple IPv6 multicast addresses that would apply to the device.

Improve this answer
3
  • Well at least all traffic sent or destined to the host's primary MAC address. It's certainly possible for a host to have multiple MAC addresses.
    – Peter Green
    Oct 24, 2017 at 1:34
  • @PeterGreen also possible for a host to have multiple IP addresses. Clearly, whether you capture by IP or by MAC address, you would need to account for multiple addresses if they are in use.
    – YLearn
    Oct 24, 2017 at 1:40
  • Yup and multiple IPs is more likely than multiple MACs so filtering by MAC is a better option, just pointing out that it's not absolutely guaranteed to catch everything.
    – Peter Green
    Oct 24, 2017 at 1:44
3

If your 'device' is a single, simply-behaved, IP host then capturing specified by IP address is good.

If however it's a router you might want to filter by ethernet address, as indicated in the first answer. Be warned though if the ethernet address is changing: such as for Hot Standby Router Protocol (HSRP) where routers can use different ethernet addresses.

Indeed, some computers change ethernet address if they are doing various kinds of masquerading or have multiple interfaces.

Also, remember non-IP packets! You might be surprised at how much of it is around.

Lastly, don't forget IPv6. If your device is doing IPv6 you might miss something.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.