53
votes
Accepted
TCPDump - Filter by MAC Address
You have used the following as your packet filter: host aa:bb:cc:11:22:33
As it stands, this is looking for an IP or hostname but you are giving it a MAC address.
To use a MAC address, you need to ...
- 26.7k
47
votes
How does a switch learn a switch table?
Layer 2 switches (bridges) have a MAC address table that contains a MAC address and physical port number. Switches follow this simple algorithm for forwarding frames:
When a frame is received, the ...
- 62k
34
votes
How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?
MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a ...
- 92.8k
34
votes
Accepted
Why is the CAM table in a switch called CAM table and not MAC table even though it holds MAC addresses?
CAM (Content Addressable Memory) is memory that can be addressed by content, rather than a numeric memory address. You can look up the interface by presenting the memory with the MAC address. This is ...
- 92.8k
33
votes
Accepted
How does a switch learn a MAC address not in its lookup table?
Good question. I'll answer it with an animation:
When Host A sends the frame, the switch does not have anything in its MAC address table. Upon receiving the frame, it records Host A's MAC Address to ...
- 13.9k
22
votes
Accepted
What is the least possible separation of two NICs with the same MAC address?
Suppose you have two NICs with the same MAC address, but not necessarily the same IP address.
You can't have that within the same link-layer segment. Identical MAC addresses will disable reliable ...
- 69.5k
21
votes
Accepted
How are IP addresses mapped to MAC addresses?
The mechanism is called Address Resolution Protocol (ARP). Every ethernet IPv4 device ARPs to resolve ethernet mac addresses for target IPs. IP to mac mappings are stored in each device's ARP table (...
- 1,914
21
votes
Accepted
Can my MAC address be identified by a web site?
In general it is not possible for a web site that you access to learn your MAC address. However there are special cases where the server could learn your MAC address:
IPv6 supports assigning ...
- 764
21
votes
Does every host on the LAN share the same ARP table, or do hosts keep them individually?
Actually, every interface in a device has its own ARP table. A host could have several ARP tables (one for each interface it has). ARP tables are not shared between hosts, or even among interfaces in ...
- 92.8k
19
votes
Accepted
How can there be more than one MAC address on single switch port?
You can have more than one MAC address on a switch port if:
You have a switch connected to it. Could be another managed switch (like a Cisco) or an unmanaged switch (like a consumer Netgear or ...
- 1,783
19
votes
Accepted
How does a switch know where to route packet, when there is another switch in front of the destination?
A Layer 2 switch learns most of its information about the location of other endpoints via "listening" to ingressing frames, and when it is not aware of the location, it uses floodingand will learn ...
- 1,669
17
votes
Accepted
Why the first octet of a MAC address always end with a binary 0?
You may notice that two least-significant bits of the most-significant byte of a 48-bit MAC address are usually set to 0 (as in all your examples). There are two flags in the most-significant byte of ...
- 92.8k
16
votes
Finding Non-Cisco End Device IP Addresses Connected to Cisco Switch
Perform a show mac address-table interface <switchport> on the switch that has the device(s) connected to it.
switch#show mac address-table int gi1/0/34
Mac Address Table
------------...
- 3,119
16
votes
Reason for both a MAC and an IP address
The IP address and MAC address serve different (but crucial) purposes:
The MAC address gets a frame from one NIC to the next. The IP address gets a packet from one Computer to the Server
So given the ...
- 13.9k
16
votes
Can my MAC address be identified by a web site?
No, a remote site will only learn what public IP address you're using, not the MAC address of your device, unless you're using IPv6 with a EUI-64 address. In that case, your MAC address could be ...
- 15.6k
15
votes
How are IP addresses mapped to MAC addresses?
Since the question was tagged with IPv6, I'll answer for that because IPv6 is very different from IPv4.
To begin with, there is no such thing as ARPv6. The mapping between layer 2 and IPv6 addresses ...
- 588
15
votes
Accepted
SVI as a DHCP client
You can configure an SVI as a dhcp client by using the following command within the SVI.
ip address dhcp
The same command is used on physical interfaces as well.
- 746
15
votes
Why do we need MAC Address if we can uniquely identify each machine with an IP Address
There is a historical reason for this, as @ronmaupin alludes to.
In small networks, you don't need a layer 3 protocol. All the devices are directly addressable, so layer 2 addresses work fine. As ...
- 62k
15
votes
How Does A Layer 2 Switch Differentiate Between Different Networks?
A (layer-2) switch doesn't care at all about the IP networks you run through it.
however, no normal traffic can occur between two nodes on two different networks.
That is correct. Different IP ...
- 69.5k
14
votes
Why is the CAM table in a switch called CAM table and not MAC table even though it holds MAC addresses?
CAM - Content Addressable Memory, referring to the memory used for the MAC address table.
It works kind of reverse from RAM, you address it by giving it content and it returns you the address where ...
- 1,402
13
votes
Accepted
What use are MAC addresses?
Well, but how does it find out it's [www.example.com's] MAC address needed for 802.11 data link layer?
Your computer doesn't, nor does it need to do so. Since the MAC address is only used within the ...
- 26.7k
13
votes
Accepted
Does the source MAC address of a frame change when it passes through several switches?
No. If all the switches are layer-2 switches, the frames are switched without any changes.
Only with routers, including layer-3 switches where the packets need to cross to other VLANs, will the ...
- 92.8k
12
votes
Accepted
What are EUI-48 and EUI-64?
Historically, both EUI-48 and MAC-48 were concatenations of a 24-bit OUI (Organizationally Unique Identifier) assigned by the IEEE and a 24-bit extension identifier assigned by the organization with ...
- 171
12
votes
Accepted
Does a switch always get a MAC address from a PC?
A switch learns the source MAC from the sender. If the destination is not in the CAM table, the switch floods the frame out all ports. So if the receiver never responds, the switch will never learn ...
- 62k
12
votes
Do routers change MAC address of packets when forwarding
When a frame comes into a router, the router strips off and discards the frame, losing any layer-2 addressing, including MAC addresses. The router will build a new frame for the next interface.
Not ...
- 92.8k
12
votes
Accepted
Does an unmanaged switch deal with IP addresses at all
An unmanaged switch doesn't use/care for/understand IP addresses at all.
A managed L2 switch uses IP addresses for management only. Some L2 switches also support limited L3/IP functionality like ACLs. ...
- 69.5k
11
votes
Do Bluetooth Devices have MAC address with the same specification as the MAC addresses of the Ethernet and Wi-Fi Network cards?
Bluetooth devices are required to have a unique device
address, assigned from the same registry as Ethernet and Wifi MAC addresses. Quoting the Bluetooth specification version 5.0 volume 1:
Each ...
- 243
10
votes
Accepted
Find MAC address of a remote computer using IP
Getting a MAC address requires the ability to get broadcast traffic.
ARP is a broadcast protocol and is therefore only available on a LAN.
Once traffic is routed you are unable to get the MAC ...
- 387
10
votes
Accepted
Why don't we use MAC address instead of IP for having "Internet" or doing communication?
MAC is Media Access Control which provides physical connectivity only. IP Address provides Host or Network interface Identification and Location addressing.
For your second question, Let we have two ...
- 226
10
votes
Accepted
What does a switch do when the destination MAC address is unknown?
I think you are confused. The destination MAC address for any destination not on your LAN is the MAC address of the gateway configured in your source host.
MAC addresses are layer-2 addresses, and ...
- 92.8k
Only top scored, non community-wiki answers of a minimum length are eligible