[44179] in North American Network Operators' Group
RE: wireless traffic
daemon@ATHENA.MIT.EDU (Dave O'Shea)
Fri Nov 9 21:12:08 2001
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Date: Fri, 9 Nov 2001 20:12:00 -0600
Message-ID: <0B311B7BB0411B4C81A18E9F003ADC6507569C@wdlndc2.telentente.com>
From: "Dave O'Shea" <doshea@telentente.com>
To: "Steven M. Bellovin" <smb@research.att.com>,
"Andrew Brown" <atatat@atatdot.net>
Cc: <Valdis.Kletnieks@vt.edu>,
"Art Houle" <houle@zeppo.acns.fsu.edu>, <nanog@merit.edu>
Errors-To: owner-nanog-outgoing@merit.edu
Way Back When, I think that IEEE was the party that handed out prefixes
to be used as MAC addresses. I know several people have compiled lists
at one time or another.
There's a neat little app for palm OS handhelds called Ethertools*, that
had a reasonably comprehensive list of the well-known ones.
(*Of course similarly formatted MAC addresses are present on other
multi-access mediums as well. I recall pulling out a lot of hair
figuring out how 3Com ended up with what looked like two MAC's on every
token-ring card. Turned out to be the same address, but token ring was
small-endian vs. big-endian. Or vice versa.)
-----Original Message-----
From: Steven M. Bellovin [mailto:smb@research.att.com]
Sent: Friday, November 09, 2001 10:29 AM
To: Andrew Brown
Cc: Valdis.Kletnieks@vt.edu; Art Houle; nanog@merit.edu
Subject: Re: wireless traffic=20
In message <20011109104400.A6249@noc.untraceable.net>, Andrew Brown
writes:
>
>>> Does anybody know where I can locate a list of MAC address prefixes
that
>>> belong specifically to wireless NIC cards? I am looking for a
method of
>>> discovering what devices on my network are wireless devices.
>>
>>Power down the wireless hub and see who calls? ;)
>>
>>Seriously though - your wireless hub/transmitter may have a queryable
>>arp table that will tell you what's not using the wire....
>
>i've used/seen cards with these prefixes:
>
> 00:e0:29 - smc
> 00:02:2d - orinoco/wavelan cards (lucent/agere)
>
I'm sending this via a Lucent card with prefix 0:60:1d. A glance at my=20
ARP table for a wireless-only segment shows 0:4:dd, 0:3:6b, 8:0:20,=20
0:0:c, 0:c0:b7, 0:d0:b7, 8:0:6a, and more.
--Steve Bellovin, http://www.research.att.com/~smb
Full text of "Firewalls" book now at
http://www.wilyhacker.com
