3

When I send a UDP packet with wrong source MAC address but with right source IP address, assuming a reply is sent, will I get the reply because I have right source IP address, or I will not get the reply because I have wrong source MAC address?

  • 1
    Do you mean on the same network, or across networks? – Ron Maupin Nov 12 '18 at 17:07
  • @RonMaupin both please – pointers Nov 12 '18 at 17:13
  • MAC addresses are contained in the frame headers, which are stripped off when packets traverse a router to get to a different network. The MAC addresses are lost when communicating with a different network. – Ron Maupin Nov 12 '18 at 17:15
  • @RonMaupin I know that the router will change the souce mac to his source mac, but when the replay will back to me via this router , how this router will know to move the replay packet to me , if I have wrong source mac? will it move by my source ip? and if is there a switch between me and router , how the replay packet will back to me? – pointers Nov 12 '18 at 17:17
  • "I know that the router will change the souce mac to his source mac" That's not what happens. A router completely strips off the frame. It builds a new frame for the next interface. Not all protocols use MAC addressing, only the IEEE protocols. If your router is connecting to a WAN, it may be using a different protocol that doesn't use MAC addressing, and it builds a new frame for that protocol. There are some IEEE protocols that use 48-bit MAC addresses, and some that use 64-*bit MAC addresses. The frame is only relevant on the same network. – Ron Maupin Nov 12 '18 at 17:21
4

Consider the following network, with correct addressing, masks and the obvious routes.

       B   K
       |.2 |.?   10.0.0.0/24
===+===+===+================
   |.1
   R
   |.1        10.0.1.0/24
===+===+===+=======+========
       |.2 |.?     |.4
       A   J       X

Case 1: Local

A sends packet to X with correct IP source address but incorrect source MAC address

Result: frame arrives at switch, which updates its CAM table, then frame arrives at X, which updates its ARP table, hands UDP packet upstairs in its stack, which generates a reply. Reply to A's IP address will get wrapped in the wrong ether address for the poisoned ARP cache. The switch will normally send the reply towards the original sender, but potentially if the incorrect ethernet address is that of another host J, that host will receive the frame and do whatever it likes with it. If no host actually has that ether address, J might still be able to snoop the frame, depending on the details of the switches. What happens next depends on the upper protocol, whether A notices it hasn't had a reply and starts resending, etc.

Case 2: Remote

B sends packet to X with correct IP source address but incorrect source MAC address

B sends frame through the switch, which updates its CAM table, to R, which might conceivably reject it. More likely it updates its ARP cache for B, and forwards the packet to X.

X receives and formulates reply, which will be directed to R because B is not local. R receives the packet, see it's for a local network, and wraps in ether with the poisoned ether address from its cache. Just like the local case, depending on the details of the switch, K could be the destination, or able to snoop the frame.

Notes

I've described the ordinary situation with common operating systems, switches, and routers; these are designed to minimise the management required, at the cost of being open to certain kinds of problem.

You'll see that in the local and remote cases, the thing that goes wrong is that an ARP cache is updated with incorrect information, and switches' CAM tables. The usual reason for this kind of frame with incorrect ether source address is an intended ARP cache poisoning attack, and very occasionally innocent misconfiguration of something.

Many operating systems therefore allow settings to lock ARP cache entries, to prevent J and K stealing the mail of their neighbours A and B. Routers and switches also have facilities for preventing such things.

  • 1
    The switch cam tables would be poisoned as well, so the ability to snoop from unicast flooding is unlikely. – Ricky Beam Nov 12 '18 at 18:58
  • Thanks Ricky for picking it up; you're of course right and I updated with commentary about switches. – jonathanjo Nov 12 '18 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.