Re: All MAC addresses for subnet 41:41:41:41:41:41

[Sagar Belure <sagar.belure () gmail com>]

Sorry that I missed some more information to be included:

I'm trying pivot the arpscanning through a compromised machine which has
following interfaces:

Interface  1
============
Name         : Software Loopback Interface 1
Hardware MAC : 00:00:00:00:00:00
MTU          : 1500
IPv4 Address : 127.0.0.1
IPv4 Netmask : 255.0.0.0


Interface 11
============
Name         : Intel(R) xxxxxLM Gigabit Network Connection
Hardware MAC : 18:03:73:xx:xx:xx
MTU          : 1500
IPv4 Address : 192.168.16.14
IPv4 Netmask : 255.255.255.0


Interface 20
============
Name         : WAN (PPP/SLIP) Interface
Hardware MAC : 00:00:00:00:00:00
MTU          : 1400
IPv4 Address : 192.168.0.7
IPv4 Netmask : 255.255.255.255

Oh, and now only I observed that its a PPP/SLIP interface. So L2 is missing
and no MAC addresses or some stuff. I'm not that good in networks.

Thanks,
Sagar Belure



On Tue, Feb 28, 2012 at 6:02 PM, Sagar Belure <sagar.belure () gmail com>wrote:

> meterpreter > run arp_scanner -r 192.168.0.0/24
> [*] ARP Scanning 192.168.0.0/24
> [*] IP: 192.168.0.3 MAC 41:41:41:41:41:41
> [*] IP: 192.168.0.0 MAC 41:41:41:41:41:41
> [*] IP: 192.168.0.1 MAC 41:41:41:41:41:41
> [*] IP: 192.168.0.9 MAC 41:41:41:41:41:41
> [*] IP: 192.168.0.2 MAC 41:41:41:41:41:41
> [*] IP: 192.168.0.8 MAC 41:41:41:41:41:41
> [*] IP: 192.168.0.7 MAC 41:41:41:41:41:41
> <..snip..>
>
> [*] IP: 192.168.0.255 MAC 41:41:41:41:41:41
> [*] IP: 192.168.0.254 MAC 41:41:41:41:41:41
>
> </..snip..>
>
> Has anyone came across this problem?
> Indeed, I found some live hosts having port(80,135,443,445) open on some
> of the hosts.
> But, could not figure out the possibility of all IP addresses bounded to
> the same MAC address.
>
> Can someone please lend some light on this?
>
> Thanks,
> Sagar Belure
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework