RE: Bad packets


Subject: RE: Bad packets
From: Mike Tibor (tibor@lib.uaa.alaska.edu)
Date: Mon Nov 17 2003 - 09:23:14 AKST


On Sun, 16 Nov 2003, Jim Gribbin wrote:

>
> Maybe I'm missing something here. I thought the hardware (mac) address
> was something fixed, usually assigned to the device by the
> manufacturer, whereas the IP address was something assigned
> dynamically when the system boots.

That's generally the case, although I believe it's part of some ethernet
spec that the mac address must be able to be overridden by the user or
system. I can't remember the reasoning behind that, but I think it was
maybe related to certain protocols like Digital's LAT. I dunno. I do
know that I have yet to see a system where I wasn't able to specify
whatever mac address I wanted via one mechanism or another.

And Mike Barsalou wrote:

> I also read that it is considered spoofing if the hardware address
> doesn't match the IP address. Is this correct?

No, the mac address is totally independent of the IP address. Systems use
the arp protocol to discover the mac address of a system who's IP address
they have. In a way it's similar to how dns works--you know you want to
get to www.aklug.org, but you need to resolve that to an IP address before
you can get there.

Ethereal and tcpdump illustrates this stuff very well.

Mike

---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.



This archive was generated by hypermail 2a23 : Mon Nov 17 2003 - 09:23:17 AKST