53 votes
Accepted

TCPDump - Filter by MAC Address

You have used the following as your packet filter: host aa:bb:cc:11:22:33 As it stands, this is looking for an IP or hostname but you are giving it a MAC address. To use a MAC address, you need to ...
user avatar
  • 26.7k
47 votes

How does a switch learn a switch table?

Layer 2 switches (bridges) have a MAC address table that contains a MAC address and physical port number. Switches follow this simple algorithm for forwarding frames: When a frame is received, the ...
user avatar
  • 62k
34 votes

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a ...
user avatar
  • 92.8k
34 votes
Accepted

Why is the CAM table in a switch called CAM table and not MAC table even though it holds MAC addresses?

CAM (Content Addressable Memory) is memory that can be addressed by content, rather than a numeric memory address. You can look up the interface by presenting the memory with the MAC address. This is ...
user avatar
  • 92.8k
33 votes
Accepted

How does a switch learn a MAC address not in its lookup table?

Good question. I'll answer it with an animation: When Host A sends the frame, the switch does not have anything in its MAC address table. Upon receiving the frame, it records Host A's MAC Address to ...
user avatar
  • 13.9k
22 votes
Accepted

What is the least possible separation of two NICs with the same MAC address?

Suppose you have two NICs with the same MAC address, but not necessarily the same IP address. You can't have that within the same link-layer segment. Identical MAC addresses will disable reliable ...
user avatar
  • 69.5k
21 votes
Accepted

How are IP addresses mapped to MAC addresses?

The mechanism is called Address Resolution Protocol (ARP). Every ethernet IPv4 device ARPs to resolve ethernet mac addresses for target IPs. IP to mac mappings are stored in each device's ARP table (...
user avatar
  • 1,914
21 votes
Accepted

Can my MAC address be identified by a web site?

In general it is not possible for a web site that you access to learn your MAC address. However there are special cases where the server could learn your MAC address: IPv6 supports assigning ...
user avatar
  • 764
21 votes

Does every host on the LAN share the same ARP table, or do hosts keep them individually?

Actually, every interface in a device has its own ARP table. A host could have several ARP tables (one for each interface it has). ARP tables are not shared between hosts, or even among interfaces in ...
user avatar
  • 92.8k
19 votes
Accepted

How can there be more than one MAC address on single switch port?

You can have more than one MAC address on a switch port if: You have a switch connected to it. Could be another managed switch (like a Cisco) or an unmanaged switch (like a consumer Netgear or ...
user avatar
  • 1,783
19 votes
Accepted

How does a switch know where to route packet, when there is another switch in front of the destination?

A Layer 2 switch learns most of its information about the location of other endpoints via "listening" to ingressing frames, and when it is not aware of the location, it uses floodingand will learn ...
user avatar
  • 1,669
17 votes
Accepted

Why the first octet of a MAC address always end with a binary 0?

You may notice that two least-significant bits of the most-significant byte of a 48-bit MAC address are usually set to 0 (as in all your examples). There are two flags in the most-significant byte of ...
user avatar
  • 92.8k
16 votes

Finding Non-Cisco End Device IP Addresses Connected to Cisco Switch

Perform a show mac address-table interface <switchport> on the switch that has the device(s) connected to it. switch#show mac address-table int gi1/0/34 Mac Address Table ------------...
user avatar
16 votes

Reason for both a MAC and an IP address

The IP address and MAC address serve different (but crucial) purposes: The MAC address gets a frame from one NIC to the next. The IP address gets a packet from one Computer to the Server So given the ...
user avatar
  • 13.9k
16 votes

Can my MAC address be identified by a web site?

No, a remote site will only learn what public IP address you're using, not the MAC address of your device, unless you're using IPv6 with a EUI-64 address. In that case, your MAC address could be ...
user avatar
  • 15.6k
15 votes

How are IP addresses mapped to MAC addresses?

Since the question was tagged with IPv6, I'll answer for that because IPv6 is very different from IPv4. To begin with, there is no such thing as ARPv6. The mapping between layer 2 and IPv6 addresses ...
user avatar
15 votes
Accepted

SVI as a DHCP client

You can configure an SVI as a dhcp client by using the following command within the SVI. ip address dhcp The same command is used on physical interfaces as well.
user avatar
15 votes

Why do we need MAC Address if we can uniquely identify each machine with an IP Address

There is a historical reason for this, as @ronmaupin alludes to. In small networks, you don't need a layer 3 protocol. All the devices are directly addressable, so layer 2 addresses work fine. As ...
user avatar
  • 62k
15 votes

How Does A Layer 2 Switch Differentiate Between Different Networks?

A (layer-2) switch doesn't care at all about the IP networks you run through it. however, no normal traffic can occur between two nodes on two different networks. That is correct. Different IP ...
user avatar
  • 69.5k
14 votes

Why is the CAM table in a switch called CAM table and not MAC table even though it holds MAC addresses?

CAM - Content Addressable Memory, referring to the memory used for the MAC address table. It works kind of reverse from RAM, you address it by giving it content and it returns you the address where ...
user avatar
  • 1,402
13 votes
Accepted

What use are MAC addresses?

Well, but how does it find out it's [www.example.com's] MAC address needed for 802.11 data link layer? Your computer doesn't, nor does it need to do so. Since the MAC address is only used within the ...
user avatar
  • 26.7k
13 votes
Accepted

Does the source MAC address of a frame change when it passes through several switches?

No. If all the switches are layer-2 switches, the frames are switched without any changes. Only with routers, including layer-3 switches where the packets need to cross to other VLANs, will the ...
user avatar
  • 92.8k
12 votes
Accepted

What are EUI-48 and EUI-64?

Historically, both EUI-48 and MAC-48 were concatenations of a 24-bit OUI (Organizationally Unique Identifier) assigned by the IEEE and a 24-bit extension identifier assigned by the organization with ...
user avatar
12 votes
Accepted

Does a switch always get a MAC address from a PC?

A switch learns the source MAC from the sender. If the destination is not in the CAM table, the switch floods the frame out all ports. So if the receiver never responds, the switch will never learn ...
user avatar
  • 62k
12 votes

Do routers change MAC address of packets when forwarding

When a frame comes into a router, the router strips off and discards the frame, losing any layer-2 addressing, including MAC addresses. The router will build a new frame for the next interface. Not ...
user avatar
  • 92.8k
12 votes
Accepted

Does an unmanaged switch deal with IP addresses at all

An unmanaged switch doesn't use/care for/understand IP addresses at all. A managed L2 switch uses IP addresses for management only. Some L2 switches also support limited L3/IP functionality like ACLs. ...
user avatar
  • 69.5k
11 votes

Do Bluetooth Devices have MAC address with the same specification as the MAC addresses of the Ethernet and Wi-Fi Network cards?

Bluetooth devices are required to have a unique device address, assigned from the same registry as Ethernet and Wifi MAC addresses. Quoting the Bluetooth specification version 5.0 volume 1: Each ...
user avatar
  • 243
10 votes
Accepted

Find MAC address of a remote computer using IP

Getting a MAC address requires the ability to get broadcast traffic. ARP is a broadcast protocol and is therefore only available on a LAN. Once traffic is routed you are unable to get the MAC ...
user avatar
  • 387
10 votes
Accepted

Why don't we use MAC address instead of IP for having "Internet" or doing communication?

MAC is Media Access Control which provides physical connectivity only. IP Address provides Host or Network interface Identification and Location addressing. For your second question, Let we have two ...
user avatar
10 votes
Accepted

What does a switch do when the destination MAC address is unknown?

I think you are confused. The destination MAC address for any destination not on your LAN is the MAC address of the gateway configured in your source host. MAC addresses are layer-2 addresses, and ...
user avatar
  • 92.8k

Only top scored, non community-wiki answers of a minimum length are eligible