Security Basics mailing list archives
RE: Re[2]: bridge detection
From: "David Gillett" <gillettdavid () fhda edu>
Date: Wed, 29 Dec 2004 11:16:17 -0800
Bridges USE the layer 2 header information to perform their function. They don't *change* it, though, so their MAC address won't show up in the traffic. [The original poster used "bridge", but I believe he actually meant "gateway"; I believe he included an apology that English is not his first language.... Gateways, of course, DO change the MAC address of traffic they handle -- to whatever the owner wants! Very often, it's a clone of the MAC address of a single device previously at that location, so that the provider sees no change even though the device has been replaced.] David Gillett
-----Original Message----- From: P. Schmiel [mailto:secfoc () cybernox net] Sent: Tuesday, December 28, 2004 4:31 PM To: security-basics () securityfocus com Subject: Re[2]: bridge detection bridges are layer2 devices, so maybe you can take a look at the source MAC address. greetings Pascal Schmiel schmiel () cybernox net
Current thread:
- bridge detection G.P.M (Dec 28)
- Re: bridge detection Danux (Dec 28)
- RE: bridge detection David Gillett (Dec 28)
- Re: bridge detection Joe Hood (Dec 28)
- Re[2]: bridge detection P. Schmiel (Dec 29)
- RE: Re[2]: bridge detection David Gillett (Dec 29)
- Re: bridge detection Joe Hood (Dec 28)
- Re: bridge detection Aaron Berg (Dec 28)