DComTalk.com

Affan · Guest

Can some one tell me exactly what happens if we have duplicate MAC
address on the same LAN (no switch in between). Also assume that they
have statily different IP's assigned. My gues is that both NIC's should
get the packet and if the s/w stack is correctly implemented, the
incorrect destination should then drop it.

Also I am guessing that if we have DHCP on this LAN, would we have two
hosts with same IP or some sort of IP ringing?

Thanks
Affan

James Knott · Guest

Affan wrote:

Walter Roberson · Guest

In article <x7SdnSehJbYCC2_cRVn-3w@rogers.com>,
James Knott <james.knott@rogers.com> wrote:
:Affan wrote:

:> Can some one tell me exactly what happens if we have duplicate MAC
:> address on the same LAN (no switch in between). Also assume that they
:> have statily different IP's assigned.

:If I recall correctly, if a NIC detects a duplicate MAC, it's supposed to
:shut down. Also, a switch will have no effect, as it's supposed to be
:transparent.

No, a switch is a form of learning bridge, which means that it has
to watch the source MAC addresses on the packets going through and
record the MAC against that port. Then when a packet comes in destined
for that MAC, the switch sends it only to the appropriate port. In
the case where you have two devices on the same VLAN with the same MAC,
the switch would send the packet to whichever of the ports that
had last received a packet with that MAC -- each received packet
re-learns the location, so you can end up with "port-flapping"
[which can be a serious problem if you have multiple VLANs but your
switch does not do per-VLAN MAC learning.]

--
Studies show that the average reader ignores 106% of all statistics
they see in .signatures.

News Me · Guest

James Knott wrote:
[snip]

News Me · Guest

Affan wrote:

Walter Roberson · Guest

In article <x7SdnSehJbYCC2_cRVn-3w@rogers.com>,
James Knott <james.knott@rogers.com> wrote:
:Affan wrote:

:> Can some one tell me exactly what happens if we have duplicate MAC
:> address on the same LAN (no switch in between). Also assume that they
:> have statily different IP's assigned. My gues is that both NIC's should
:> get the packet and if the s/w stack is correctly implemented, the
:> incorrect destination should then drop it.

:If I recall correctly, if a NIC detects a duplicate MAC, it's supposed to
:shut down.

That is if the NIC -detects- that something else is using it's MAC.
Which would require that the other device transmits packets.

There is a form of stateful failover that is sometimes implimented which is
handled by having two devices both assuming the same MAC, so that
the standby device receives a copy of all the packets destined to
the master device, and follows along in its song-book. When the master
device dies, the standby device assumes control without having to
kill the connections. The same thing could, of course, also be done
with the secondary device snooping for those packets and changing it's
MAC address when the master fails.

:> and if the s/w stack is correctly implemented, the
:> incorrect destination should then drop it.

If the s/w stack is correctly implimented, the "incorrect" destination
will offer a way of capturing all packets, such as for tcpdump /
ethereal. When such a mode is activated, the exact details of what
happens for mismatched IPs with the correct MAC varies. For example for
some OS's, an icmp unreachable will be generated for protocols -other-
than TCP or UDP, but the TCP and UDP stacks filter at a different point
and know enough not to act on the packets. These differences in
operation are exploited by "anti-sniffer" software designed to
locate equipment that is snooping on the net.
--
Ceci, ce n'est pas une idée.

James Knott · Guest

Walter Roberson wrote:

stephen · Guest

"Affan" <affanahmed@gmail.com> wrote in message
news:1106415398.729518.154750@c13g2000cwb.googlegroups.com...

Affan Syed · Guest

stephen · Guest

"Affan Syed" <asyed@usc.edu> wrote in message
news:csv7l8$9oa$1@gist.usc.edu...

Walter Roberson · Guest

In article <csv7l8$9oa$1@gist.usc.edu>, Affan Syed <asyed@usc.edu> wrote:
:> When such a mode is activated, the exact details of what
:> happens for mismatched IPs with the correct MAC varies.

:> These differences in
:> operation are exploited by "anti-sniffer" software designed to
:> locate equipment that is snooping on the net.

:Could you explain a little bit more on this?

The particular software I was thinking of was L0pht's anti-sniffer
released in 1999. packetstormsecurity appears to have similar software,
http://packetstormsecurity.nl/sniffers/antisniff/as-101.exe
--
Warhol's Law: every Usenet user is entitled to his or her very own
fifteen minutes of flame -- The Squoire

glen herrmannsfeldt · Guest

News Me wrote:

Walter Roberson · Guest

In article <mPydnbS6-6LXf2jcRVn-3g@comcast.com>,
glen herrmannsfeldt <gah@ugcs.caltech.edu> wrote:
:News Me wrote:
:> Huh? A switch would most certainly have an effect, at least if it's
:> switching at layer 2.

:That is what normally happens, but I don't know about this
:case. A switch that doesn't know the destination should send
:it on all ports.

All ports within the same VLAN, yes.

:It it is getting the same MAC from more than
:one port, it could decide that it doesn't know the port.

It -could-, but it is unlikely. Switches are built to take into
account the possibility that a device will move before their
table time out, and update their tables almost immediately
when that happens. If the MAC shows up on two different ports,
then port-flapping is the usual result.

I believe I have heard of some switches with port-flapping
protection. If I recall correctly, those switches usually effectively
shut down transmissions to that MAC for a time -- dropping
the relevant packets rather than flooding them. Switches I
haven't encountered yet might handle things differently.
--
WW{Backus,Church,Dijkstra,Knuth,Hollerith,Turing,vonNeumann}D ?

	DComTalk.com Forum Index -> Ethernet	All times are GMT
Page 1 of 1