send to MAC A, reply from MAC B, same IP. Whats going on ?
I have a linksys wireless AP and router. I have been monitoring my ethernet traffic on the wireless laptop (cant put the card into promiscuous mode), so I know I cant see all the traffic that is out there.
I have WEP and I know its trivial to break it, I am suspicious it has been broken, but I have not changed the key- because I need to prove it to my SO that we need to get WAP.
I noticed something odd yesterday. This is my configuration: 1 wireless laptop A, one computer wired directly connected to router with cable, B
router ip: 192.168.1.1
Wireless PORT on the router: 00:11:22:33:44:55:90
Port to which wired Computer B is connected: 00:11:22:33:44:55:8E
Arp table on wireless computer shows: 192.168.1.1 -->00:11:22:33:44:55:8E
since the MAC address is that of the wired port, I was wondering what is going on, so I made a static arp entry in wireless comp A
192.168.1.1 -->00:11:22:33:44:55:90
Something I did not expect happened,as I watehced the packets with ethereal.
My outgoing packets has ethernet address of the actual wireless port MAC, which I just added ie., 00:11:22:33:44:55:90, BUT the incoming packets has the reply coming from 00:11:22:33:44:55:8E.
My questions:
Is there a logical explanation for this ?
If someone was masquerading as 00:11:22:33:44:55:8E/192.168.1.1 AP, would that not cause a problem with the real AP having 8E as a port(wired port)
Can there be NICS on the same network with same mac-address -what happens then ?
Since my wired computer A is connected to the physical 00:11:22:33:44:55:8E port, can someone who is a wireless NIC of the same MAC 00:11:22:33:44:55:8E -hear traffic from my wired computer-which is destined for the router ?
Thanks