MAC address can be manufactured?

Hi,
under worm attack , MAC address can be manufactured like IP Smurfing?
in Smurfing attack , source IP address can be manufactured. What about Mac
address?

Have a day.

In article <deh1fm$eln$1@tnews.hananet.net>,
"somez72" <somez72@hansfos.com> writes:
>
> under worm attack , MAC address can be manufactured like IP Smurfing?
> in Smurfing attack , source IP address can be manufactured. What about Mac
> address?

I don't know if any worms actually do it, but masquerading a MAC address
is possible. Under Linux, you can do this with the "hw class <address>"
option to ifconfig. The man page description for this option says it's
dependent upon the kernel driver for the device, and I believe the same is
true for the Windows equivalent. I can't think of any reason a worm would
do this unless it were designed to attack its own local network, though.
If the worm were attacking remote networks, the MAC address (genuine or
faked) would be lost once the attack packets got through a router.

--
Rod Smith, rodsmith@rodsbooks.com
http://www.rodsbooks.com
Author of books on Linux, FreeBSD, and networking

Rod Smith wrote:
> In article <deh1fm$eln$1@tnews.hananet.net>,
> "somez72" <somez72@hansfos.com> writes:
>
>>under worm attack , MAC address can be manufactured like IP Smurfing?
>>in Smurfing attack , source IP address can be manufactured. What about Mac
>>address?
>
>
> I don't know if any worms actually do it, but masquerading a MAC address
> is possible. Under Linux, you can do this with the "hw class <address>"
> option to ifconfig. The man page description for this option says it's
> dependent upon the kernel driver for the device, and I believe the same is
> true for the Windows equivalent. I can't think of any reason a worm would
> do this unless it were designed to attack its own local network, though.
> If the worm were attacking remote networks, the MAC address (genuine or
> faked) would be lost once the attack packets got through a router.
>

historically windows couldnt do spoofing. not sure about now. MAC
addresses can certainly be changed, but not sure about on the fly or per
frame.

--
Respectfully,


CL Gilbert

Well, MAC address can also be changed. Both windows and *nix platform
supports that.



--
Raqueeb Hassan
Bangladesh

somez72 wrote:
> Hi,
> under worm attack , MAC address can be manufactured like IP Smurfing?
> in Smurfing attack , source IP address can be manufactured. What about Mac
> address?
>

Yes, they can, butbut ...

The MAC address is only good for determining a host
in your local network, it's not transferred over
routers. To look for a wormcan with only the MAC
known, you're likely to find your network gateway
(which is pretty probably *not* the culprit).

--

Tauno Voipio
tauno voipio (at) iki fi