[gentoo-user] MAC addresses

[gentoo-user] MAC addresses

[Sergey A. Kobzar]

Hello.

I have Gentoo server Linux 2.6.27-gentoo-r8 x86_64 connected to
LinkSys switch. It has 2 NICs onboard:

eth0      Link encap:Ethernet  HWaddr 00:15:17:1a:6e:6c
eth1      Link encap:Ethernet  HWaddr 00:15:17:1a:6e:6d

2nd NIC is connected to LinkSys switch, but the switch shows that
device connected to the port has other MAC address:

VLAN ID   VLAN 3
MAC       00:15:17:1a:6e:6f
Port      g31

The difference in last symbol.

How is it possible?


-- 
Sergey

[gentoo-user] Re: MAC addresses

[James]

Sergey A. Kobzar <sergey.kobzar <at> mail.ru> writes:


> LinkSys switch. It has 2 NICs onboard:

> How is it possible?


Often the MAC is printed on the nic. Some (few) devices
have MAC set in firmware and it is hackable. 
MAC numbering is often suspect in a variety of
circumstances. My suggestion is that
you surf the open source tools to find something
that reveals deeper information about your MAC
anomalies. Lots of stuff in:


/usr/portage/net-analyzer/


Here's one:


net-analyzer/macchanger

Description:         Utility for viewing/manipulating 
the MAC address of network interfaces


goodluck,


James

Re: [gentoo-user] Re: MAC addresses

[Sergey A. Kobzar]

Thursday, April 30, 2009, 6:22:27 PM, James wrote:

> Sergey A. Kobzar <sergey.kobzar <at> mail.ru> writes:


>> LinkSys switch. It has 2 NICs onboard:

>> How is it possible?


> Often the MAC is printed on the nic. Some (few) devices
> have MAC set in firmware and it is hackable. 
> MAC numbering is often suspect in a variety of
> circumstances. My suggestion is that
> you surf the open source tools to find something
> that reveals deeper information about your MAC
> anomalies. Lots of stuff in:


> /usr/portage/net-analyzer/


> Here's one:


> net-analyzer/macchanger

> Description:         Utility for viewing/manipulating 
> the MAC address of network interfaces


James, thank you for the useful tip. The output of macchanger:

# macchanger eth1
Current MAC: 00:15:17:1a:6e:6d (Intel Corporate)
Faked MAC:   00:15:17:1a:6e:6e (Intel Corporate)


# macchanger eth0
Current MAC: 00:15:17:1a:6e:6c (Intel Corporate)
Faked MAC:   00:15:17:1a:6e:6d (Intel Corporate)


How is it possible? I thought NIC has one MAC only.What does mean
'Faked MAC'?



> goodluck,


> James



-- 
Sergey

Re: [gentoo-user] Re: MAC addresses

[Anthony Metcalf]

Sergey A. Kobzar wrote:
> James, thank you for the useful tip. The output of macchanger:
> # macchanger eth1
> Current MAC: 00:15:17:1a:6e:6d (Intel Corporate)
> Faked MAC:   00:15:17:1a:6e:6e (Intel Corporate)
>
>
> # macchanger eth0
> Current MAC: 00:15:17:1a:6e:6c (Intel Corporate)
> Faked MAC:   00:15:17:1a:6e:6d (Intel Corporate)
>
>
> How is it possible? I thought NIC has one MAC only.What does mean
> 'Faked MAC'?
>   
Current MAC = MAC in firmware on the card, Faked MAC = MAC the OS is
telling the network?

Re: [gentoo-user] Re: MAC addresses

[Eric Martin]

[-- Attachment #1: Type: text/plain, Size: 746 bytes --]

Anthony Metcalf wrote:
> Sergey A. Kobzar wrote:
>   
>> James, thank you for the useful tip. The output of macchanger:
>> # macchanger eth1
>> Current MAC: 00:15:17:1a:6e:6d (Intel Corporate)
>> Faked MAC:   00:15:17:1a:6e:6e (Intel Corporate)
>>
>>
>> # macchanger eth0
>> Current MAC: 00:15:17:1a:6e:6c (Intel Corporate)
>> Faked MAC:   00:15:17:1a:6e:6d (Intel Corporate)
>>
>>
>> How is it possible? I thought NIC has one MAC only.What does mean
>> 'Faked MAC'?
>>   
>>     
> Current MAC = MAC in firmware on the card, Faked MAC = MAC the OS is
> telling the network?
>
>
>   
yes, you can set the mac to what ever you want.  There's a line in
/etc/conf.d/net that explains how to do this (with macchanger).




[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 899 bytes --]

Re: [gentoo-user] Re: MAC addresses

[James Stull]

[-- Attachment #1: Type: text/plain, Size: 896 bytes --]

You can actually change your MAC address using ifconfig for many types of
NIC's.

--James

2009/4/30 Eric Martin <freak4uxxx@gmail.com>

> Anthony Metcalf wrote:
> > Sergey A. Kobzar wrote:
> >
> >> James, thank you for the useful tip. The output of macchanger:
> >> # macchanger eth1
> >> Current MAC: 00:15:17:1a:6e:6d (Intel Corporate)
> >> Faked MAC:   00:15:17:1a:6e:6e (Intel Corporate)
> >>
> >>
> >> # macchanger eth0
> >> Current MAC: 00:15:17:1a:6e:6c (Intel Corporate)
> >> Faked MAC:   00:15:17:1a:6e:6d (Intel Corporate)
> >>
> >>
> >> How is it possible? I thought NIC has one MAC only.What does mean
> >> 'Faked MAC'?
> >>
> >>
> > Current MAC = MAC in firmware on the card, Faked MAC = MAC the OS is
> > telling the network?
> >
> >
> >
> yes, you can set the mac to what ever you want.  There's a line in
> /etc/conf.d/net that explains how to do this (with macchanger).
>
>
>
>

[-- Attachment #2: Type: text/html, Size: 1418 bytes --]

Re[2]: [gentoo-user] Re: MAC addresses

[Sergey A. Kobzar]

Thursday, April 30, 2009, 7:27:43 PM, James wrote:

> You can actually change your MAC address using ifconfig for many types of NIC's.

> --James

> 2009/4/30 Eric Martin <freak4uxxx@gmail.com>

> Anthony Metcalf wrote:
>> Sergey A. Kobzar wrote:
>>
>>> James, thank you for the useful tip. The output of macchanger:
>>> # macchanger eth1
>>> Current MAC: 00:15:17:1a:6e:6d (Intel Corporate)
>>> Faked MAC:   00:15:17:1a:6e:6e (Intel Corporate)
>>>
>>>
>>> # macchanger eth0
>>> Current MAC: 00:15:17:1a:6e:6c (Intel Corporate)
>>> Faked MAC:   00:15:17:1a:6e:6d (Intel Corporate)
>>>
>>>
>>> How is it possible? I thought NIC has one MAC only.What does mean
>>> 'Faked MAC'?
>>>
>>>
>> Current MAC = MAC in firmware on the card, Faked MAC = MAC the OS is
>> telling the network?
>>
>>
>>

> yes, you can set the mac to what ever you want.  There's a line in
> /etc/conf.d/net that explains how to do this (with macchanger).


No, I didn't change MAC by OS. My /etc/conf.d/net file:

config_eth0=( "aa.bb.cc.dd netmask 255.255.255.224" )
routes_eth0=( "default via 1.2.3.4" )

config_eth1=( "10.11.1.203 netmask 255.255.255.0" )

Nothing that changes MAC addresses for the NICs...

Maybe it's BIOS feature for failover.. It seems I need reboot server
to check BIOS settings.

-- 
Sergey

Re: [gentoo-user] MAC addresses

[Daniel Troeder]

[-- Attachment #1: Type: text/plain, Size: 891 bytes --]

On Thu, 2009-04-30 at 18:09 +0300, Sergey A. Kobzar wrote:
> Hello.
> 
> I have Gentoo server Linux 2.6.27-gentoo-r8 x86_64 connected to
> LinkSys switch. It has 2 NICs onboard:
> 
> eth0      Link encap:Ethernet  HWaddr 00:15:17:1a:6e:6c
> eth1      Link encap:Ethernet  HWaddr 00:15:17:1a:6e:6d
> 
> 2nd NIC is connected to LinkSys switch, but the switch shows that
> device connected to the port has other MAC address:
> 
> VLAN ID   VLAN 3
> MAC       00:15:17:1a:6e:6f
> Port      g31
> 
> The difference in last symbol.
> 
> How is it possible?

I suggest, to first check which device/OS is telling the truth. Use
wireshark to capture and review some traffic. Maybe this helps analyse
the situation.

Bye,
Daniel

-- 
PGP key @ http://pgpkeys.pca.dfn.de/pks/lookup?search=0xBB9D4887&op=get
# gpg --recv-keys --keyserver hkp://subkeys.pgp.net 0xBB9D4887


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re[2]: [gentoo-user] MAC addresses

[Sergey A. Kobzar]

Thursday, April 30, 2009, 10:34:28 PM, Daniel wrote:

> On Thu, 2009-04-30 at 18:09 +0300, Sergey A. Kobzar wrote:
>> Hello.
>> 
>> I have Gentoo server Linux 2.6.27-gentoo-r8 x86_64 connected to
>> LinkSys switch. It has 2 NICs onboard:
>> 
>> eth0      Link encap:Ethernet  HWaddr 00:15:17:1a:6e:6c
>> eth1      Link encap:Ethernet  HWaddr 00:15:17:1a:6e:6d
>> 
>> 2nd NIC is connected to LinkSys switch, but the switch shows that
>> device connected to the port has other MAC address:
>> 
>> VLAN ID   VLAN 3
>> MAC       00:15:17:1a:6e:6f
>> Port      g31
>> 
>> The difference in last symbol.
>> 
>> How is it possible?

> I suggest, to first check which device/OS is telling the truth. Use
> wireshark to capture and review some traffic. Maybe this helps analyse
> the situation.


I've started this thread because connection to the server is unstable
and I see such reports from other servers:

+arp: 10.11.1.203 moved from 00:15:17:1a:6e:6f to 00:15:17:1a:6e:6d on em1
+arp: 10.11.1.203 moved from 00:15:17:1a:6e:6d to 00:15:17:1a:6e:6f on em1
+arp: 10.11.1.203 moved from 00:15:17:1a:6e:6f to 00:15:17:1a:6e:6d on em1
+arp: 10.11.1.203 moved from 00:15:17:1a:6e:6d to 00:15:17:1a:6e:6f on em1
+arp: 10.11.1.203 moved from 00:15:17:1a:6e:6f to 00:15:17:1a:6e:6d on em1

BIOS tells that NIC1 has 00:15:17:1a:6e:6c MAC and NIC2 has
00:15:17:1a:6e:6d. It's strange that 00:15:17:1a:6e:6d MAC is common
for both NICs.


> Bye,
> Daniel




-- 
Sergey

Re[3]: [gentoo-user] MAC addresses

[Sergey A. Kobzar]

Thursday, April 30, 2009, 10:48:06 PM, Sergey wrote:

> Thursday, April 30, 2009, 10:34:28 PM, Daniel wrote:

>> On Thu, 2009-04-30 at 18:09 +0300, Sergey A. Kobzar wrote:
>>> Hello.
>>> 
>>> I have Gentoo server Linux 2.6.27-gentoo-r8 x86_64 connected to
>>> LinkSys switch. It has 2 NICs onboard:
>>> 
>>> eth0      Link encap:Ethernet  HWaddr 00:15:17:1a:6e:6c
>>> eth1      Link encap:Ethernet  HWaddr 00:15:17:1a:6e:6d
>>> 
>>> 2nd NIC is connected to LinkSys switch, but the switch shows that
>>> device connected to the port has other MAC address:
>>> 
>>> VLAN ID   VLAN 3
>>> MAC       00:15:17:1a:6e:6f
>>> Port      g31
>>> 
>>> The difference in last symbol.
>>> 
>>> How is it possible?

>> I suggest, to first check which device/OS is telling the truth. Use
>> wireshark to capture and review some traffic. Maybe this helps analyse
>> the situation.


> I've started this thread because connection to the server is unstable
> and I see such reports from other servers:

> +arp: 10.11.1.203 moved from 00:15:17:1a:6e:6f to 00:15:17:1a:6e:6d on em1
> +arp: 10.11.1.203 moved from 00:15:17:1a:6e:6d to 00:15:17:1a:6e:6f on em1
> +arp: 10.11.1.203 moved from 00:15:17:1a:6e:6f to 00:15:17:1a:6e:6d on em1
> +arp: 10.11.1.203 moved from 00:15:17:1a:6e:6d to 00:15:17:1a:6e:6f on em1
> +arp: 10.11.1.203 moved from 00:15:17:1a:6e:6f to 00:15:17:1a:6e:6d on em1

> BIOS tells that NIC1 has 00:15:17:1a:6e:6c MAC and NIC2 has
> 00:15:17:1a:6e:6d. It's strange that 00:15:17:1a:6e:6d MAC is common
> for both NICs.


I think this happens because Intel NIC Teaming is enabled for the NIC.
Is it possible check this using Linux and disable teaming if needed?


-- 
Sergey