I'm trying to use tcprewrite to change the source MAC address of some packets. I deliberately chose the prefix AB:CD:EF that does not belong to any hardware manufacturer so that I can distinguish such packets from other real packets. The packets are played to a server via a Cisco switch.
I realized that my server can't capture any packets with the MAC prefix AB:CD:EF, but when I changed the prefix to 00:00:08, which belongs to Xerox, these packets can be captured.
Is this because the switch can tell that the AB:CD:EF MAC prefix is not valid and drops the packets?
2 Answers
0xAB is 10101011. Those last two bits signify locally-administered and multicast.
I expect that, and a poisoned ARP-cache, cause the symptoms you see.
See Wikipedia
If the least significant bit of the most significant address octet is set to 1, the frame will still be sent only once; however, NICs will choose to accept it based on different criteria than a matching MAC address: for example, based on a configurable list of accepted multicast MAC addresses. This is called multicast addressing.
The IEEE has assigned AC-DE-48 to “PRIVATE”. They use that as an example value in some of their documents.
0Most likely because there's no Ethernet interface with such MAC address. Try changing your MAC address to that and see what happens.
2
