50
You have used the following as your packet filter: host aa:bb:cc:11:22:33
As it stands, this is looking for an IP or hostname but you are giving it a MAC address.
To use a MAC address, you need to include the ether packet filter primitive.
In your case, the following should work:
sudo tcpdump ether host aa:bb:cc:11:22:33
Or, if it needs you to specify ...
41
Layer 2 switches (bridges) have a MAC address table that contains a MAC address and port number. Switches follow this simple algorithm for forwarding packets:
When a frame is received, the switch compares the SOURCE MAC address to the MAC address table. If the SOURCE is unknown, the switch adds it to the table along with the port number the packet was ...
40
MAC addresses only need to be unique in a local broadcast domain, not globally, so re-use of MAC addresses in different networks usually isn't a problem.
The internet isn't one global broadcast domain and thus needs to be divided into many blocks of addresses assigned to different ISP's and each ISP divides his blocks into smaller blocks for different ...
34
MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a lot of work for very little return.
You need a comprehensive security policy which can include such things as:
Physical access limitations
802.1X as @robut ...
31
CAM (Content Addressable Memory) is memory that can be addressed by content, rather than a numeric memory address. You can look up the interface by presenting the memory with the MAC address. This is done in a single CPU cycle vs. the traditional programming of searching through a table, which will cost many CPU cycles.
There is also TCAM (Ternary Content ...
30
MAC addresses and IP addresses operate on different layers of the internet protocol suite. MAC addresses are used to identify machines within the same broadcast network on layer 2, while IP addresses are used on layer 3 to identify machines throughout different networks.
Even if your computer has an IP address, it still needs a MAC address to find other ...
29
Good question. I'll answer it with an animation:
When Host A sends the frame, the switch does not have anything in its MAC address table. Upon receiving the frame, it records Host A's MAC Address to Switch Port mapping. Since it doesn't know where the destination MAC address is, it floods the frame out all ports.
This assures that if host B exists (which ...
24
When you understand that IP-to-IP communication is really just a series of MAC-to-MAC communication taking place at each router hop, then you'll see why both are necessary.
The IP header of a packet leaving your workstation destined to an IP in a different subnet will maintain the source IP and destination IP, forgetting about NAT for the moment. [Later, ...
22
without going into OSI model, TCP layer, etc.:
Back in time, networks were created: some computers would communicate with each other to share something. TO do that, they need to know who was talking and who was being talked to. So, instead of giving each computer a name, we gave them an ID. This ID is called MAC address, is should uniquely identity each ...
22
Suppose you have two NICs with the same MAC address, but not necessarily the same IP address.
You can't have that within the same link-layer segment. Identical MAC addresses will disable reliable switching/bridging.
What is the least possible separation (in terms of number of switches, routers, different IP subnets etc.) needed that would still allow ...
21
In general it is not possible for a web site that you access to learn your MAC address. However there are special cases where the server could learn your MAC address:
IPv6 supports assigning addresses in a way which embed the MAC address in the IP address. For privacy reasons this way of assigning IPv6 addresses is not very common.
If you are directly ...
20
The mechanism is called Address Resolution Protocol (ARP). Every ethernet IPv4 device ARPs to resolve ethernet mac addresses for target IPs. IP to mac mappings are stored in each device's ARP table (the phone book in your analogy).
To simplify: In most cases, to resolve the MAC address associated with an IP address, you send a broadcast ARP packet (to all ...
19
You can have more than one MAC address on a switch port if:
You have a switch connected to it. Could be another managed switch (like a Cisco) or an unmanaged switch (like a consumer Netgear or Linksys switch).
You have a virtual server host attached to it with multiple virtual machines sharing the NIC.
You're using a VoIP phone to carry data for a computer. ...
19
Actually, every interface in a device has its own ARP table. A host could have several ARP tables (one for each interface it has). ARP tables are not shared between hosts, or even among interfaces in the same host, but a host may hear ARP traffic on the network and update the ARP table of the interface where the ARP traffic is heard.
17
A Layer 2 switch learns most of its information about the location of other endpoints via "listening" to ingressing frames, and when it is not aware of the location, it uses floodingand will learn from the answer. Lets say the topology is:
(Host A) <--> (Switch A) <--> (Switch B) <-->(Host B).
Also important to note, a L2 Switch forwards, it ...
17
You may notice that two least-significant bits of the most-significant byte of a 48-bit MAC address are usually set to 0 (as in all your examples). There are two flags in the most-significant byte of the OUI (Organizationally Unique Identifier, which are the most-significant 24-bits) part of the MAC address:
The least-significant bit is the I/G (Individual/...
16
There isn't anything physically stopping you from designing network which has just IP address for L2 and L3. Then 'ethernet switch' would learn SIP address of incoming packets and flood or forward towards DIP address.
However this network would only ever support IP, when next-generation of IPvX comes, it would not work, as the 'ethernet switch' couldn't ...
16
Not all types of network interfaces use MAC addresses. MAC addresses are mostly associated with Ethernet, though quite a few other networking standards do use it. However, an IPv6 address can still be assigned to a network interface that doesn't use MAC addresses for Layer 2.
Also of note, a MAC address can be converted to an IPv6 host portion through EUI-...
16
No, a remote site will only learn what public IP address you're using, not the MAC address of your device, unless you're using IPv6 with a EUI-64 address. In that case, your MAC address could be derived from the IPv6 address.
15
Putting multiple IP addresses on a single interface (and thus a single MAC address) is quite common for servers.
For example: if a server has multiple roles and services running on it, it might be a good idea to give each role/service its own IP address. When you later want to move a role/service to a different machine you can do so without disrupting the ...
15
You can configure an SVI as a dhcp client by using the following command within the SVI.
ip address dhcp
The same command is used on physical interfaces as well.
15
Perform a show mac address-table interface <switchport> on the switch that has the device(s) connected to it.
switch#show mac address-table int gi1/0/34
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
132 001b.78d5.a2d7 DYNAMIC ...
14
Since the question was tagged with IPv6, I'll answer for that because IPv6 is very different from IPv4.
To begin with, there is no such thing as ARPv6. The mapping between layer 2 and IPv6 addresses is done by the Neighbor Discovery Protocol (NDP), which is sent over ICMPv6. Thus, you must not ignore ICMPv6 and filter it away, as is the custom with legacy ...
14
CAM - Content Addressable Memory, referring to the memory used for the MAC address table.
It works kind of reverse from RAM, you address it by giving it content and it returns you the address where the content is stored - which is then used to find the egress port for this address.
13
Well, but how does it find out it's [www.example.com's] MAC address needed for 802.11 data link layer?
Your computer doesn't, nor does it need to do so. Since the MAC address is only used within the same L2 network, when you are sending traffic to a different L3 network, all it needs to know is that www.example.com is on a different L3 network and how to ...
12
As long as the NICs are in completely different layer-2 broadcast domains, it shouldn't be a problem, but it is a headache waiting to happen when one of them is moved. If there are just two offending NICs, it's probably better to replace one.
answered Aug 28 '13 at 14:24
chrylis -cautiouslyoptimistic-
1,0561 gold badge8 silver badges14 bronze badges
12
I am assuming you're using "bridge-mode" for networking (your internal, virtual adapter is bridged to your host's physical adapter).
In any case (unless you explicitlly manually set them to the same address, which causes a lot of other problems), your guest (WinXP) machine will have a different MAC address than your host (CentOS). Due to bridge-mode, your ...
12
Historically, both EUI-48 and MAC-48 were concatenations of a 24-bit OUI (Organizationally Unique Identifier) assigned by the IEEE and a 24-bit extension identifier assigned by the organization with that OUI assignment (NIC). The subtle difference between EUI-48 and MAC-48 was not well understood; as a result, the term MAC-48 is now obsolete and the term EUI-...
12
No. If all the switches are layer-2 switches, the frames are switched without any changes.
Only with routers, including layer-3 switches where the packets need to cross to other VLANs, will the frames be stripped and rewritten for the new network or VLAN.
12
There is a historical reason for this, as @ronmaupin alludes to.
In small networks, you don't need a layer 3 protocol. All the devices are directly addressable, so layer 2 addresses work fine. As networks got bigger and became interconnected, there was a need to know how to get from one network to another. That is the function of routing, which is done ...
Only top voted, non community-wiki answers of a minimum length are eligible
