2

I want to do some very simple traffic analysis for a single device. I'm using tcpdump to collect this data. Is there an advantage to using a MAC address capture filter over a (static) IP address for the host? If so, what?

-1

If you are using static IP addreses there is not a single advantage of filtering by MAC because there is a one-to-one relationship among them, except if the device has a single interface and more than one IP address. In that case we're talking of a "one-to-many" relationship.

In DHCP environments it could happen that an IP address is used by a device now and by another later. In that case is useful to filter by MAC so you can follow the behavior of the same device despite of the IP adddress changing behavior.

Keep in mind that MAC addresses are local. IP packets coming from other LANs through a router, will have the original source MAC replaced with the router's MAC address.

  • Static IP addresses aren't necessarily one-to-one: for example a server might have multiple IP addresses for very many reasons. – jonathanjo Oct 20 '17 at 16:43
  • Yes, you're right. A server could have more than one IP address related to the same MAC address. i've modified the answer to explain that. – jcbermu Oct 23 '17 at 8:04
4

Is there an advantage to using a MAC address capture filter over a (static) IP address for the host?

Depending on the purpose of the capture, certainly.

If so, what?

The advantage of capturing based on MAC address is that you are guaranteed to get all traffic sent or destined to the host.

If you only capture based on IP address, you will not get any non-IP based traffic such as ARP. This would also include any IPv6 traffic if you are capturing based on an IPv4 address.

If you are using an IPv6 address for your filter, you wouldn't get any IPv4 traffic and capturing based on IPv6 can be a bit more complicated as there is often a link-local address, a global address and multiple IPv6 multicast addresses that would apply to the device.

  • Well at least all traffic sent or destined to the host's primary MAC address. It's certainly possible for a host to have multiple MAC addresses. – Peter Green Oct 24 '17 at 1:34
  • @PeterGreen also possible for a host to have multiple IP addresses. Clearly, whether you capture by IP or by MAC address, you would need to account for multiple addresses if they are in use. – YLearn Oct 24 '17 at 1:40
  • Yup and multiple IPs is more likely than multiple MACs so filtering by MAC is a better option, just pointing out that it's not absolutely guaranteed to catch everything. – Peter Green Oct 24 '17 at 1:44
3

If your 'device' is a single, simply-behaved, IP host then capturing specified by IP address is good.

If however it's a router you might want to filter by ethernet address, as indicated in the first answer. Be warned though if the ethernet address is changing: such as for Hot Standby Router Protocol (HSRP) where routers can use different ethernet addresses.

Indeed, some computers change ethernet address if they are doing various kinds of masquerading or have multiple interfaces.

Also, remember non-IP packets! You might be surprised at how much of it is around.

Lastly, don't forget IPv6. If your device is doing IPv6 you might miss something.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.