Re: wireless traffic

[Spencer.Wood () dot state oh us]

Cisco Access Points start out with 0040.96


************************************************************
Spencer Wood, Network Manager
Ohio Department Of Transportation
1320 Arthur E. Adams Drive
Columbus, Ohio 43221 
E-Mail: Spencer.Wood () dot state oh us
Phone: 614.387.0710/Fax: 815.361.0714/Pager: 866.591.9954 
************************************************************* 




"Steven M. Bellovin" <smb () research att com>
Sent by: owner-nanog () merit edu
11/09/2001 11:29 AM

 
        To:     Andrew Brown <atatat () atatdot net>
        cc:     Valdis.Kletnieks () vt edu, Art Houle <houle () zeppo acns fsu edu>, 
nanog () merit edu
        Subject:        Re: wireless traffic



In message <20011109104400.A6249 () noc untraceable net>, Andrew Brown 
writes:
> > > Does anybody know where I can locate a list of MAC address prefixes 
that
> > > belong specifically to wireless NIC cards?  I am looking for a method 
of
> > > discovering what devices on my network are wireless devices.
> >
> > Power down the wireless hub and see who calls? ;)
> >
> > Seriously though - your wireless hub/transmitter may have a queryable
> > arp table that will tell you what's not using the wire....
>
> i've used/seen cards with these prefixes:
>
> 00:e0:29 - smc
> 00:02:2d - orinoco/wavelan cards (lucent/agere)

I'm sending this via a Lucent card with prefix 0:60:1d.  A glance at my 
ARP table for a wireless-only segment shows 0:4:dd, 0:3:6b, 8:0:20, 
0:0:c, 0:c0:b7, 0:d0:b7, 8:0:6a, and more.

                                 --Steve Bellovin, http://www.research.att.com/~smb
                                 Full text of "Firewalls" book now at http://www.wilyhacker.com