Security Incidents mailing list archives

RE: Odd addresses on my wireless network


From: "James C Slora Jr" <Jim.Slora () phra com>
Date: Wed, 24 Nov 2004 18:10:05 -0500

Michael Acosta wrote Tuesday, November 23, 2004 22:45

$ arp -a
? (10.0.1.1) at 0:3:93:e7:36:da on en1 [ethernet]
? (10.0.1.250) at 0:11:24:3:77:c4 on en1 [ethernet]
? (169.254.61.156) at 0:11:24:3:77:c4 on en1 [ethernet]
? (169.254.255.255) at (incomplete) on en1 [ethernet]
? (224.0.0.2) at 1:0:5e:0:0:2 on en1 permanent [ethernet]
? (224.0.0.251) at 1:0:5e:0:0:fb on en1 permanent [ethernet]
? (239.255.255.253) at 1:0:5e:7f:ff:fd on en1 permanent [ethernet]

Nothing in your arp list appears to indicate that you had involvement from
any device other than the two you own. Of course and arp list is far from a
complete record of activity.

239.255.255.253 = uPnP (disable on router if not needed)
224.0.0.x = Multicast IP addresses (router autodiscovery, etc)
1:0:5e:x:x:x = Multicast MAC addresses (separate from hardware MAC
addresses)
169.254.x.x = Automatic private addressing (no DHCP server available for
devices configured as DHCP clients)
169.254.255.255 = Broadcast address for automatic private addressing space

Airport Express Firmware 6.1 automatically checks for other WDS nodes - new
autodiscovery feature, introduced 2004-11-15 per Apple's site. This sounds
relevant to your issues. Did they occur after a firmware update?


Current thread: