56
votes
Accepted
TCPDump - Filter by MAC Address
You have used the following as your packet filter: host aa:bb:cc:11:22:33
As it stands, this is looking for an IP or hostname but you are giving it a MAC address.
To use a MAC address, you need to ...
- 27.1k
34
votes
How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?
MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a ...
- 97.7k
34
votes
Accepted
How does a switch learn a MAC address not in its lookup table?
Good question. I'll answer it with an animation:
When Host A sends the frame, the switch does not have anything in its MAC address table. Upon receiving the frame, it records Host A's MAC Address to ...
- 14.5k
34
votes
Accepted
Why is the CAM table in a switch called CAM table and not MAC table even though it holds MAC addresses?
CAM (Content Addressable Memory) is memory that can be addressed by content, rather than a numeric memory address. You can look up the interface by presenting the memory with the MAC address. This is ...
- 97.7k
22
votes
Does every host on the LAN share the same ARP table, or do hosts keep them individually?
Actually, every interface in a device has its own ARP table. A host could have several ARP tables (one for each interface it has). ARP tables are not shared between hosts, or even among interfaces in ...
- 97.7k
22
votes
Accepted
What is the least possible separation of two NICs with the same MAC address?
Suppose you have two NICs with the same MAC address, but not necessarily the same IP address.
You can't have that within the same link-layer segment. Identical MAC addresses will disable reliable ...
- 79.8k
21
votes
Accepted
Can my MAC address be identified by a web site?
In general it is not possible for a web site that you access to learn your MAC address. However there are special cases where the server could learn your MAC address:
IPv6 supports assigning ...
- 764
20
votes
Accepted
How does a switch know where to route packet, when there is another switch in front of the destination?
A Layer 2 switch learns most of its information about the location of other endpoints via "listening" to ingressing frames, and when it is not aware of the location, it uses floodingand will learn ...
- 1,679
17
votes
Accepted
Why the first octet of a MAC address always end with a binary 0?
You may notice that two least-significant bits of the most-significant byte of a 48-bit MAC address are usually set to 0 (as in all your examples). There are two flags in the most-significant byte of ...
- 97.7k
17
votes
How Does A Layer 2 Switch Differentiate Between Different Networks?
A (layer-2) switch doesn't care at all about the IP networks you run through it.
however, no normal traffic can occur between two nodes on two different networks.
That is correct. Different IP ...
- 79.8k
16
votes
Can my MAC address be identified by a web site?
No, a remote site will only learn what public IP address you're using, not the MAC address of your device, unless you're using IPv6 with a EUI-64 address. In that case, your MAC address could be ...
- 16.6k
16
votes
Why do we need MAC Address if we can uniquely identify each machine with an IP Address
There is a historical reason for this, as @ronmaupin alludes to.
In small networks, you don't need a layer 3 protocol. All the devices are directly addressable, so layer 2 addresses work fine. As ...
- 66.1k
15
votes
Why is the CAM table in a switch called CAM table and not MAC table even though it holds MAC addresses?
CAM - Content Addressable Memory, referring to the memory used for the MAC address table.
It works kind of reverse from RAM, you address it by giving it content and it returns you the address where ...
- 1,591
13
votes
Accepted
What are EUI-48 and EUI-64?
Historically, both EUI-48 and MAC-48 were concatenations of a 24-bit OUI (Organizationally Unique Identifier) assigned by the IEEE and a 24-bit extension identifier assigned by the organization with ...
- 189
13
votes
Accepted
What use are MAC addresses?
Well, but how does it find out it's [www.example.com's] MAC address needed for 802.11 data link layer?
Your computer doesn't, nor does it need to do so. Since the MAC address is only used within the ...
- 27.1k
13
votes
Accepted
Does the source MAC address of a frame change when it passes through several switches?
No. If all the switches are layer-2 switches, the frames are switched without any changes.
Only with routers, including layer-3 switches where the packets need to cross to other VLANs, will the ...
- 97.7k
13
votes
Do routers change MAC address of packets when forwarding
When a frame comes into a router, the router strips off and discards the frame, losing any layer-2 addressing, including MAC addresses. The router will build a new frame for the next interface.
Not ...
- 97.7k
12
votes
Accepted
Does a switch always get a MAC address from a PC?
A switch learns the source MAC from the sender. If the destination is not in the CAM table, the switch floods the frame out all ports. So if the receiver never responds, the switch will never learn ...
- 66.1k
12
votes
Accepted
Does an unmanaged switch deal with IP addresses at all
An unmanaged switch doesn't use/care for/understand IP addresses at all.
A managed L2 switch uses IP addresses for management only. Some L2 switches also support limited L3/IP functionality like ACLs. ...
- 79.8k
11
votes
Do Bluetooth Devices have MAC address with the same specification as the MAC addresses of the Ethernet and Wi-Fi Network cards?
Bluetooth devices are required to have a unique device
address, assigned from the same registry as Ethernet and Wifi MAC addresses. Quoting the Bluetooth specification version 5.0 volume 1:
Each ...
- 243
10
votes
Accepted
Find MAC address of a remote computer using IP
Getting a MAC address requires the ability to get broadcast traffic.
ARP is a broadcast protocol and is therefore only available on a LAN.
Once traffic is routed you are unable to get the MAC ...
- 387
10
votes
Accepted
Why don't we use MAC address instead of IP for having "Internet" or doing communication?
MAC is Media Access Control which provides physical connectivity only. IP Address provides Host or Network interface Identification and Location addressing.
For your second question, Let we have two ...
- 226
10
votes
Accepted
What does a switch do when the destination MAC address is unknown?
I think you are confused. The destination MAC address for any destination not on your LAN is the MAC address of the gateway configured in your source host.
MAC addresses are layer-2 addresses, and ...
- 97.7k
9
votes
Accepted
Raw-Ethernet Frames
First, Wi-Fi (IEEE 802.11) is not ethernet (IEEE 802.3) any more than token ring (IEEE 802.5) or any of the other IEEE LAN standards other than 802.3 are ethernet. The frame headers are different for ...
- 97.7k
9
votes
Find MAC address of a remote computer using IP
No. MAC addresses only have significance on a LAN. Different LAN types have difference kinds of MAC addresses. Knowing the MAC address of a host on a different LAN is meaningless.
- 97.7k
9
votes
Accepted
Learning of MAC addresses with cut-through switching?
Cut-trough switching is not a standard. Actually it violates the 802.1D standard in some (minor) aspects.
So each vendor implement it on its own way and there's not a single answer to this question.
...
- 19.3k
9
votes
Accepted
Why do we need MAC Address if we can uniquely identify each machine with an IP Address
Don't confuse the network layers. Each layer has a specific purpose. Also, don't assume that there is only one protocol for each layer. Layer-2 has many protocols, some of which use MAC addresses, and ...
- 97.7k
9
votes
Accepted
Does Switch need its own MAC address?
The basic function of a switch is transparent bridging - for this, it doesn't need any MAC address of its own.
However, if you need to talk to a switch - ie. a managed switch - then that switch ...
- 79.8k
9
votes
Does every host on the LAN share the same ARP table, or do hosts keep them individually?
To answer the question another way: what mechanisms might be available to share an ARP table? This is one of the fundamentals for IP over ethernet (and any similar layer 2 network). If a device was ...
- 16.1k
9
votes
Accepted
How Does A Layer 2 Switch Differentiate Between Different Networks?
The switch doesn't even "see" what is going on above MAC layer. However, hosts are usually configured to send packets to another IP subnet via a default-gateway IP address. So the hosts ...
- 1,591
Only top scored, non community-wiki answers of a minimum length are eligible