RE: Re[2]: bridge detection

["David Gillett" <gillettdavid () fhda edu>]

  Bridges USE the layer 2 header information to perform their function.
They don't *change* it, though, so their MAC address won't show up in
the traffic.

  [The original poster used "bridge", but I believe he actually meant
"gateway"; I believe he included an apology that English is not his first
language....
  Gateways, of course, DO change the MAC address of traffic they handle --
to whatever the owner wants!  Very often, it's a clone of the MAC address
of a single device previously at that location, so that the provider sees
no change even though the device has been replaced.]

David Gillett


> -----Original Message-----
> From: P. Schmiel [mailto:secfoc () cybernox net]
> Sent: Tuesday, December 28, 2004 4:31 PM
> To: security-basics () securityfocus com
> Subject: Re[2]: bridge detection
>
>
> bridges are layer2 devices, so maybe you can take a look at the source
> MAC address.
>
> greetings
> Pascal Schmiel
> schmiel () cybernox net