2
Recently the Wifi network at our small company was messed up in a strange way. When I did a
arp -i en1 -a
I did in fact see the same MAC address listed twice. When I inquired with a non-technical person (the tech was indisposed), I was told the network was "messed up" and wait a few hours.
The MAC that was listed twice was for a "Motorola Mobility LLC" device and it was 10.100.100.1 and 10.100.100.130. In the past 10.100.100.1 was a Cisco device.
I tried doing a ping and got back something very strange:
Darkstar:~ username$ curl http://abc12345.org
invalid requestDarkstar:~ username$
Darkstar:~ username$ ping abc12345.org
PING abc12345.org (173.246.99.7): 56 data bytes
64 bytes from 173.246.99.7: icmp_seq=0 ttl=44 time=102.034 ms
92 bytes from 10.100.100.130: Redirect Host(New addr: 10.100.100.1)
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 d9af 0 0000 3f 01 221b 10.100.100.125 173.246.99.7
64 bytes from 173.246.99.7: icmp_seq=1 ttl=44 time=123.127 ms
92 bytes from 10.100.100.130: Redirect Host(New addr: 10.100.100.1)
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 d5b3 0 0000 3f 01 2617 10.100.100.125 173.246.99.7
64 bytes from 173.246.99.7: icmp_seq=2 ttl=44 time=98.782 ms
92 bytes from 10.100.100.130: Redirect Host(New addr: 10.100.100.1)
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 c095 0 0000 3f 01 3b35 10.100.100.125 173.246.99.7
64 bytes from 173.246.99.7: icmp_seq=3 ttl=44 time=106.846 ms
92 bytes from 10.100.100.130: Redirect Host(New addr: 10.100.100.1)
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 0054 7de4 0 0000 3f 01 7de6 10.100.100.125 173.246.99.7
64 bytes from 173.246.99.7: icmp_seq=4 ttl=44 time=105.608 ms
^C
--- abc12345.org ping statistics ---
My first question is, is the .130 device on the network having all traffic somehow magically sent through it? The second question is what is the meaning of the "Redirect Host" activity during the ping? The 3rd question is, how can one MAC appear twice in the ARP table?
This network was, I thought, a simple Wifi router going to a cable connection of some type.
1first guess: Someone munually set their MAC address to match the existing gateway to intercept all data and your FreeBSd host was the only one to mention that in pings ? – Hennes – 2015-12-16T13:32:45.963
1Somebody is ARP spoofing, and that causes big problems. Either a disgruntled, or stupid, employee is causing a DoS. – Ron Maupin – 2016-02-19T17:45:06.803
Ok. What's your question? – Polynomial – 2013-10-16T15:27:24.367