53

You have used the following as your packet filter: host aa:bb:cc:11:22:33 As it stands, this is looking for an IP or hostname but you are giving it a MAC address. To use a MAC address, you need to include the ether packet filter primitive. In your case, the following should work: sudo tcpdump ether host aa:bb:cc:11:22:33 Or, if it needs you to specify ...


46

Layer 2 switches (bridges) have a MAC address table that contains a MAC address and physical port number. Switches follow this simple algorithm for forwarding frames: When a frame is received, the switch compares the SOURCE MAC address to the MAC address table. If the SOURCE is unknown, the switch adds it to the table along with the physical port number ...


34

MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a lot of work for very little return. You need a comprehensive security policy which can include such things as: Physical access limitations 802.1X as @robut ...


34

CAM (Content Addressable Memory) is memory that can be addressed by content, rather than a numeric memory address. You can look up the interface by presenting the memory with the MAC address. This is done in a single CPU cycle vs. the traditional programming of searching through a table, which will cost many CPU cycles. There is also TCAM (Ternary Content ...


33

Good question. I'll answer it with an animation: When Host A sends the frame, the switch does not have anything in its MAC address table. Upon receiving the frame, it records Host A's MAC Address to Switch Port mapping. Since it doesn't know where the destination MAC address is, it floods the frame out all ports. This assures that if host B exists (which ...


22

Suppose you have two NICs with the same MAC address, but not necessarily the same IP address. You can't have that within the same link-layer segment. Identical MAC addresses will disable reliable switching/bridging. What is the least possible separation (in terms of number of switches, routers, different IP subnets etc.) needed that would still allow ...


21

The mechanism is called Address Resolution Protocol (ARP). Every ethernet IPv4 device ARPs to resolve ethernet mac addresses for target IPs. IP to mac mappings are stored in each device's ARP table (the phone book in your analogy). To simplify: In most cases, to resolve the MAC address associated with an IP address, you send a broadcast ARP packet (to all ...


21

In general it is not possible for a web site that you access to learn your MAC address. However there are special cases where the server could learn your MAC address: IPv6 supports assigning addresses in a way which embed the MAC address in the IP address. For privacy reasons this way of assigning IPv6 addresses is not very common. If you are directly ...


21

Actually, every interface in a device has its own ARP table. A host could have several ARP tables (one for each interface it has). ARP tables are not shared between hosts, or even among interfaces in the same host, but a host may hear ARP traffic on the network and update the ARP table of the interface where the ARP traffic is heard.


19

You can have more than one MAC address on a switch port if: You have a switch connected to it. Could be another managed switch (like a Cisco) or an unmanaged switch (like a consumer Netgear or Linksys switch). You have a virtual server host attached to it with multiple virtual machines sharing the NIC. You're using a VoIP phone to carry data for a computer. ...


19

A Layer 2 switch learns most of its information about the location of other endpoints via "listening" to ingressing frames, and when it is not aware of the location, it uses floodingand will learn from the answer. Lets say the topology is: (Host A) <--> (Switch A) <--> (Switch B) <-->(Host B). Also important to note, a L2 Switch forwards, it ...


17

You may notice that two least-significant bits of the most-significant byte of a 48-bit MAC address are usually set to 0 (as in all your examples). There are two flags in the most-significant byte of the OUI (Organizationally Unique Identifier, which are the most-significant 24-bits) part of the MAC address: The least-significant bit is the I/G (Individual/...


16

Perform a show mac address-table interface <switchport> on the switch that has the device(s) connected to it. switch#show mac address-table int gi1/0/34 Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 132 001b.78d5.a2d7 DYNAMIC ...


16

No, a remote site will only learn what public IP address you're using, not the MAC address of your device, unless you're using IPv6 with a EUI-64 address. In that case, your MAC address could be derived from the IPv6 address.


15

You can configure an SVI as a dhcp client by using the following command within the SVI. ip address dhcp The same command is used on physical interfaces as well.


15

Putting multiple IP addresses on a single interface (and thus a single MAC address) is quite common for servers. For example: if a server has multiple roles and services running on it, it might be a good idea to give each role/service its own IP address. When you later want to move a role/service to a different machine you can do so without disrupting the ...


15

The IP address and MAC address serve different (but crucial) purposes: The MAC address gets a frame from one NIC to the next. The IP address gets a packet from one Computer to the Server So given the following: Source Computer <---> RouterA <---> RouterB <---> Destination Server What directs the packet from the "Source" to ...


15

Since the question was tagged with IPv6, I'll answer for that because IPv6 is very different from IPv4. To begin with, there is no such thing as ARPv6. The mapping between layer 2 and IPv6 addresses is done by the Neighbor Discovery Protocol (NDP), which is sent over ICMPv6. Thus, you must not ignore ICMPv6 and filter it away, as is the custom with legacy ...


15

There is a historical reason for this, as @ronmaupin alludes to. In small networks, you don't need a layer 3 protocol. All the devices are directly addressable, so layer 2 addresses work fine. As networks got bigger and became interconnected, there was a need to know how to get from one network to another. That is the function of routing, which is done ...


14

CAM - Content Addressable Memory, referring to the memory used for the MAC address table. It works kind of reverse from RAM, you address it by giving it content and it returns you the address where the content is stored - which is then used to find the egress port for this address.


13

Well, but how does it find out it's [www.example.com's] MAC address needed for 802.11 data link layer? Your computer doesn't, nor does it need to do so. Since the MAC address is only used within the same L2 network, when you are sending traffic to a different L3 network, all it needs to know is that www.example.com is on a different L3 network and how to ...


13

No. If all the switches are layer-2 switches, the frames are switched without any changes. Only with routers, including layer-3 switches where the packets need to cross to other VLANs, will the frames be stripped and rewritten for the new network or VLAN.


12

Historically, both EUI-48 and MAC-48 were concatenations of a 24-bit OUI (Organizationally Unique Identifier) assigned by the IEEE and a 24-bit extension identifier assigned by the organization with that OUI assignment (NIC). The subtle difference between EUI-48 and MAC-48 was not well understood; as a result, the term MAC-48 is now obsolete and the term EUI-...


12

A switch learns the source MAC from the sender. If the destination is not in the CAM table, the switch floods the frame out all ports. So if the receiver never responds, the switch will never learn the receiver's MAC and it will always flood the frame.


12

When a frame comes into a router, the router strips off and discards the frame, losing any layer-2 addressing, including MAC addresses. The router will build a new frame for the next interface. Not all layer-2 protocols use MAC addresses, and of those that do, some are 48-bit MAC addresses, and some are 64-bit MAC addresses. It is the IEEE LAN protocols ...


12

An unmanaged switch doesn't use/care for/understand IP addresses at all. A managed L2 switch uses IP addresses for management only. Some L2 switches also support limited L3/IP functionality like ACLs. L3 switches use IP addresses for L3 forwarding = routing as well. When computer A on a local network wants to communicate with computer B for example through ...


10

If a switch were to change MAC addresses, this would break networking entirely. The MAC address is a unique identifier which is used by hosts on the local network. If the switch were to change the destination MAC, the frame would not get delivered to the appropriate host. In the cases that it would, for example if the frame gets flooded, the destination ...


10

Getting a MAC address requires the ability to get broadcast traffic. ARP is a broadcast protocol and is therefore only available on a LAN. Once traffic is routed you are unable to get the MAC address as it is stripped from the packet once it crosses the boundary of a router/L3 device. Switches have a MAC table. Routers have a routing table, in general. ...


10

I think you are confused. The destination MAC address for any destination not on your LAN is the MAC address of the gateway configured in your source host. MAC addresses are layer-2 addresses, and they are only relevant, or even used, on your layer-2 LAN. Layer-3 addresses, e.g. IPv4 or IPv6 addresses, are used to communicate with a host on another LAN. ...


10

Bluetooth devices are required to have a unique device address, assigned from the same registry as Ethernet and Wifi MAC addresses. Quoting the Bluetooth specification version 5.0 volume 1: Each Bluetooth device shall be allocated a unique 48-bit Bluetooth device address (BD_ADDR). The address shall be a 48-bit extended unique identifier (EUI-48) ...


Only top voted, non community-wiki answers of a minimum length are eligible