MAC Attack

[seekermeister]

No I'm not hungry, it's just the the firewall popped an alert that it had blocked an attack by something using the same MAC address of my primary rig, and since I have the wireless disabled, I can only imagine that this must have come from the internet.

I have seen a number of attacks blocked before, but never one such as this. It is possible that this was due to the fact that I just connected a different wireless telephone, but it works on 5.8MHz, instead of 2.4MHz like my router, so that doesn't seem to be a likely source. Is it possible that someone on the internet could be trying to hack my computer by imitating the MAC. If I understand, the MAC isn't broadcast on the internet...is it?

 

[CarlTR6]

Did you look at your firewall log to see who initiated the attack?

 

[seekermeister]

Not until you asked. There are so many logs in my firewall, I'm not sure which to look at, but it appears from the mac.log that this is the entry in question:

2010/04/15 12:38:06 recv xx-xx-xx-xx-xx-xx -> ff-ff-ff-ff-ff-ff block by 00000000 ARP:block
2010/04/15 12:38:06 recv xx-xx-xx-xx-xx-xx -> ff-ff-ff-ff-ff-ff block by 00000000 ARP:block

The problem is that I don't know how to interpet it...do you? I probably shouldn't have pasted it, since it contains the MAC address, but I guess that I can change it.

EDIT: I Decided to x out the numbers. However, the first set I didn't recognize, the second set were from my computer.

 

[Bill2]

MAC address spoofing is normally associated with wireless networks, with hackers using tools like wireshark to sniff network packets. With wired networks, like yours, one needs physical connection to the machine to access network traffic and presumably that can be controlled by the owner of the network.

Every ethernet card is theoretically assigned a unique MAC address. But really speaking, theres nothing to guarantee such uniqueness for 2 reasons:

1) Manufacturers may or may not ensure that they are unique.
2) MAC addresses can be set manually in many network interfaces.

The MAC address is used by the network to identify which piece of hardware a packet is to be sent to. So it's used only on connections from one piece of networking equipment to the next. When information leaves your computer it has your computer's MAC address, but when it leaves your router, that address is replaced by the MAC address of your router. Then when it leaves the ISPs router, it contains the MAC address of the ISPs router. So, no, the MAC address of your rigs does not travel very far.

 

[CarlTR6]

I can't interpret this one. It doesn't appear to list the source of the attack.

222.45.112.59 Not available TCP port scan detected, packet dropped

This lists the source and I can look it up via whois.

 

[CarlTR6]

Here is another sample from my firewall log/

66.228.119.250 fcp01.dal01.softlayer.com UDP port scan detected, packet dropped

 

[Jacee]

I can't interpret this one. It doesn't appear to list the source of the attack.

222.45.112.59 Not available TCP port scan detected, packet dropped

This lists the source and I can look it up via whois.

IP Information for 222.45.112.59

IP Location:

China Beijing Kunde Htech Ltd Co IP Address: 222.45.112.59


inetnum: 222.45.0.0 - 222.45.255.255
netname: HTECH
descr: Kunde Htech Ltd Co
descr: 11 Yanan Road No398,Hangzhou,Zhejiang,china
country: CN
admin-c: JX966-AP
tech-c: YF484-AP
status: ASSIGNED NON-PORTABLE
changed: 20081215
mnt-by: MAINT-CNNIC-AP
mnt-routes: MAINT-CNCGROUP-RR
source: APNIC

route: 222.32.0.0/11
descr: China TieTong Telecommunications Corporation
country: CN
origin: AS9394
mnt-by: MAINT-CNNIC-AP
changed: 20090908
source: APNIC​

​

 

[seekermeister]

MAC address spoofing is normally associated with wireless networks, with hackers using tools like wireshark to sniff network packets. With wired networks, like yours, one needs physical connection to the machine to access network traffic and presumably that can be controlled by the owner of the network.

Every ethernet card is theoretically assigned a unique MAC address. But really speaking, theres nothing to guarantee such uniqueness for 2 reasons:

1) Manufacturers may or may not ensure that they are unique.
2) MAC addresses can be set manually in many network interfaces.

The MAC address is used by the network to identify which piece of hardware a packet is to be sent to. So it's used only on connections from one piece of networking equipment to the next. When information leaves your computer it has your computer's MAC address, but when it leaves your router, that address is replaced by the MAC address of your router. Then when it leaves the ISPs router, it contains the MAC address of the ISPs router. So, no, the MAC address of your rigs does not travel very far.

So, what am I to conclude? That the alert was just a fluke?

 

[seekermeister]

I can't interpret this one. It doesn't appear to list the source of the attack.

222.45.112.59 Not available TCP port scan detected, packet dropped

This lists the source and I can look it up via whois.

That is an IP address, rather than a MAC address. I know how to track an IP, but not a MAC...can that be done?

 

[CarlTR6]

I would treat it as a fluke and closely watch for a reoccurrence. I do not know very much about MAC addresses except as they apply to my router and network.

 

[Jacee]

I found this bit of old information

Typically you would need to find it on one of your machine's arp tables. If there is a router in your network, this is usually the most central place to gather that type of info. On a cisco router, the command is "show arp" - it will give you a listing of the MAC addresses and their corresponding IP address. On a windows box, from a DOS prompt you can type "arp -a" to see similar output

.

 

[Bill2]

Somebody will only be able to see your MAC address if they are on the same subnet you are. Machines separated by a router will not see each other's MACs. To track someone on the internet via their MAC address would therefore require some external mechanism like a worm to feedback the IP address/MAC address relationship back to a central location. If tracing MAC address was a feasible idea, tracking stolen laptops would be far easier.

 

[CarlTR6]

Jacee and Billw, thank you very much for this information and for teaching me.

 

[seekermeister]

I found this bit of old information

Typically you would need to find it on one of your machine's arp tables. If there is a router in your network, this is usually the most central place to gather that type of info. On a cisco router, the command is "show arp" - it will give you a listing of the MAC addresses and their corresponding IP address. On a windows box, from a DOS prompt you can type "arp -a" to see similar output

.

I ran it in command prompt as suggested, and it appears that the first MAC was fron my secondary rig. Therefore, I assume that is what the firewall said that it blocked. I didn't suspect this, because of the fact that my W7 drive died, and the secondary is now running on XP MCE. I did attempt to set it up on the LAN a day or two ago, but I thought that had failed.

All that I did was to use the setup wizard in the secondary, which only had me to create a floppy to set it up in the primary, but when I ran it, it said that it had failed, and when I clicked on the Network link of the Start Menu, it didn't show anything from the secondary listed. Yet when I just checked again, it does list the secondary, as far as the main link, but not the media folders.

When I just checked the same in the secondary, it show an internet gateway and a LAN or High Speed Internet connection, but nothing related to files on the primary.

This network environment is beginning to make my head spin.

 

[Jacee]

@ Bill2, How to Track a Mac Address From a Stolen Computer | eHow.com

@ CarlTR6, you're welcome

 

[CarlTR6]

@ Bill2, How to Track a Mac Address From a Stolen Computer | eHow.com

Now that is cool. I will install this on my wife's laptop. Thank you again.

Wow, do I ever learn here!

Edited to add: I love this little tip:

The "Mac address" program can't send you a message if the computer is not online.

LOL

 

[seekermeister]

@ Bill2, How to Track a Mac Address From a Stolen Computer | eHow.com

Home.....

 

[Bill2]

@ Bill2, How to Track a Mac Address From a Stolen Computer | eHow.com

@ CarlTR6, you're welcome

Jacee,

1) How many of us have such a program installed on our laptop BEFORE it is stolen?

2) The "Mac address" program can't send you a message if the computer is not online. I doubt too many smart thieves go online with stolen laptops. AND, what happens if the thief hands it over straight away to a shady geek who wipes the hard drive straight away?

I was talking about real things.

 

[WindowsStar]

You can run a test here to make sure your firewall is working well:

https://www.grc.com/x/ne.dll?bh0bkyd2

 

[zzz2496]

This issue probably caused by an echo made by your network interface broadcasting to the network, then because of some peculiar instances, your switch directed the broadcast back to your computer... So basically it's talking to it self... MAC addresses are only used at "Layer 2", it won't make it to "Layer 3" (read my guide), thus concluding that it only used in a LAN, it can't go over the internet...

zzz2496