Hacker News Reader

This code will lead to a nice, self-inflicted bug that will sometimes break your network connection. The low two bits of the first byte of the MAC have a special purpose and should be kept at 0 [1]. Learned this the hard way when developing on an embedded TCP stack. The switch silently discarded packets from multicast or local MAC addresses.

[1] http://en.wikipedia.org/wiki/MAC_address#Address_details

View on HN

You can use tricks based on multicast ethernet to detect interfaces in promiscuous mode:

http://www.securityfriday.com/promiscuous_detection_01.pdf

http://nmap.org/nsedoc/scripts/sniffer-detect.html

That's pretty cool, thanks for the hint. The original PDF seems to be from 2001, does this still work?

Thank you for pointing this out.

I found this link to be more easily understandable than Wikipedia :

http://packetsdropped.wordpress.com/2011/01/13/mac-address-u...

Reply on news.ycombinator.com