Re: spoofing the ethernet address

[harnold () BINGHAMTON EDU (Arnold, Jamie)]

I have a question that one/some of you may be able to help with.  We have a
user in one of our dorms (DHCP) that is reporting his MAC address as
changing about every 10 minutes.  When he first powers-on his system, the
MAC is correct and DHCP renews his lease.  After a while, the master switch
shows his IP having about 10 different MAC addresses, all variations of the
first where the first 4 digits remain constant, the second 4 go to the last
position and the middle 4 change randomly.  Has anyone seen this, or have
any idea what's going on.  My theory is a cheap NIC with bad firmware.  We
have seen an influx of inexpensive cards coming into campus that have had
duplicate MACs or no MACs (000000000000) at all.

Thanks

******************************************************
 Jamie Arnold                   Binghamton University
 Lead Programmer/Analyst                PO Box 6000
 607-777-4229 voice             Vestal Parkway East
 607-777-6147 fax               Binghamton, NY 13902
 harnold () binghamton edu              www.binghamton.edu
******************************************************

 <'}}}><

"Life was simple before World War II. After that, we had systems."
Admiral Grace Hopper

-----Original Message-----
From: Timothy J. Miller [mailto:timothy.miller () AFIWC01 AF MIL]
Sent: Monday, March 13, 2000 8:37 AM
To: VULN-DEV () SECURITYFOCUS COM
Subject: Re: spoofing the ethernet address

"Buhrmaster, Gary" <gtb () SLAC STANFORD EDU> writes:

> It is my hazy recollection that while some TR cards didn't
> have a promiscuous mode, the important item was that the
> specification required that if you enabled promiscuous
> mode, the card was supposed to announce that fact on the
> ring so that everyone now knew that someone was listening
> (and the "management station" could go out and smack someone).

Correct.

> Of course there were ways to get around that announcement,
> there always are, but it showed some thought about the
> issues.

In my experience, TR cards are fairly notorious for not doing what
they're supposed to.  For example, we had a condition on one of our
rings where MAC address test packets were being incorrectly responded
to, but only certain revisions of the TR cards on the ring were
properly kicking themselves out.  *That* one took some time to figure
out, (using a TR sniffer, as it happened) let me tell you.  8/