Rod Smith wrote:
> In article <deh1fm$eln$1@tnews.hananet.net>,
> "somez72" <somez72@hansfos.com> writes:
>
>>under worm attack , MAC address can be manufactured like IP Smurfing?
>>in Smurfing attack , source IP address can be manufactured. What about Mac
>>address?
>
>
> I don't know if any worms actually do it, but masquerading a MAC address
> is possible. Under Linux, you can do this with the "hw class <address>"
> option to ifconfig. The man page description for this option says it's
> dependent upon the kernel driver for the device, and I believe the same is
> true for the Windows equivalent. I can't think of any reason a worm would
> do this unless it were designed to attack its own local network, though.
> If the worm were attacking remote networks, the MAC address (genuine or
> faked) would be lost once the attack packets got through a router.
>

historically windows couldnt do spoofing. not sure about now. MAC
addresses can certainly be changed, but not sure about on the fly or per
frame.

--
Respectfully,


CL Gilbert