Unit 3: Local networks · Lesson 1 of 7 · 15 min
MAC addresses and switches
See why a packet needs a MAC address as well as an IP address to cross the local wire.
mission
- You are
- The analyst mapping the office segment.
- Situation
- The helpdesk wants a list of which network card belongs to which laptop, taken from traffic rather than from stickers.
- Goal
- Pair every IP address you see on the office wire with the MAC address that sent it.
- Hand in
- The MAC address used by 10.10.0.57.
Two kinds of address on every packet
- IP addressend to end, set by the sender, kept by routers
- MAC addresshop to hop, rewritten at every router
Print both addresses
Each frame carries the MAC of the card that sent it on this wire and the IP of the machine that started the conversation.
tshark -r layers.pcap -c 2 -T fields -e eth.src -e eth.dst -e ip.src -e ip.dst
02:42:0a:0a:00:17 02:42:0a:14:00:0b 10.10.0.23 10.20.0.11
02:42:0a:14:00:0b 02:42:0a:0a:00:17 10.20.0.11 10.10.0.23
you should see The same pair of MACs, swapped, on the way back.
Build the pairing table
ARP requests carry the sender's IP and MAC side by side, which makes them the cleanest source for this table.
tshark -r arp.pcap -Y 'arp.opcode==1' -T fields -e arp.src.proto_ipv4 -e arp.src.hw_mac -e arp.dst.proto_ipv4
10.10.0.23 02:42:0a:0a:00:17 10.10.0.1
10.10.0.31 02:42:0a:0a:00:1f 10.10.0.1
10.10.0.57 02:42:0a:0a:00:39 10.10.0.1
10.10.0.23 02:42:0a:0a:00:17 10.10.0.31
10.10.0.66 02:42:0a:0a:00:42 10.10.0.23
you should see Four machines asked questions. One of them, 10.10.0.66, is not in the inventory.
defender tip A MAC address can be changed in software by anyone with admin rights. Treat it as a hint about which device sent a frame, never as proof.
One MAC address
- 1
02:42:0afirst half: the maker, or a locally chosen prefix like this one - 2
0a:00:39second half: this particular card
Find a device from its MAC
DHCP leases tie a MAC to an address and a host name. The switch table ties the same MAC to a physical port.
grep 02:42:0a:0a:00:2c inventory/dhcp-leases.txt 1760436300 02:42:0a:0a:00:2c 10.10.0.44 laptop-mchen 01:02:42:0a:0a:00:2c grep 0242.0a0a.002c inventory/switch-macs.txt 10 0242.0a0a.002c DYNAMIC Gi1/0/9
you should see laptop-mchen is 10.10.0.44 and is plugged into Gi1/0/9.
defender tip Cisco-style switches write MACs in groups of four hex digits. Same address, different punctuation.
Read the vendor part of a MAC
The first three bytes of a MAC normally name the manufacturer. The 02 at the start marks a locally assigned address, used by virtual machines and phones with private Wi-Fi addresses.
tshark -r layers.pcap -c 1 -T fields -e eth.src.oui_resolved -e eth.src
02:42:0a:0a:00:17
you should see No vendor name, because the address is locally assigned.
defender tip Phones and laptops now randomise their Wi-Fi MAC per network, so MAC-based allowlists on guest Wi-Fi are weak.
What a defender takes away
- 1IP addresses go end to end. MAC addresses only cross one wire.
- 2ARP requests are a ready-made IP to MAC table.
- 3An address that is on the wire but not in the inventory is a lead.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.