[127182] in North American Network Operators' Group
Re: Sending ARP request to unicast MAC instead of broadcast MAC
daemon@ATHENA.MIT.EDU (Ingo Flaschberger)
Wed Jun 16 22:12:12 2010
Date: Thu, 17 Jun 2010 04:10:07 +0200 (CEST)
From: Ingo Flaschberger <if@xip.at>
To: Chris Woodfield <rekoil@semihuman.com>
In-Reply-To: <7D4FBC01-E09F-4659-B620-310DCB11C20A@semihuman.com>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Dear Chris,
> OK, this sounds Really Wacky (or, Really Hacky if you're into puns) but there's a reason for it, I swear...
>
> Will typical OSS UNIX kernels (Linux, BSD, MacOS X, etc) reply to a crafted ARP request that, instead of having FF:FF:FF:FF:FF:FF as its destination MAC address, is instead sent to the already-known unicast MAC address of the host?
Try or read kernel source.
> Next, what would be your utility of choice for crafting such a packet? Or is this something one would need to code up by hand in a lower-level language?
http://www.perihel.at/sec/mz/
should be able todo this.
Kind regards,
Ingo Flaschberger
