Vulnerability Development mailing list archives

spoofing the ethernet address (PPPoE)


From: crlf () SYMPATICO CA (mike)
Date: Thu, 2 Mar 2000 11:20:57 -0500


I have recentrly read RFC 2516 for PPP over Ether,  and was wondering if
spoofing one's one mac address could cause a DoS attack against the
service.  My understanding of the initiation of the protocol is that the
client starts off by sending a Discovery packet to MAC address
FF:FF:FF:FF:FF:FF.   From what i've recently been reading on the list,
It seems that it is easy enough (on some OSes) to change one's MAC
address.  My understanding of duplicate mac addresses on a network is
that it causes unknown results, possibly making it so that other clients
trying to log on to the net (ala: Bell High Speed Edition) would have
their initial discovery packets never reach the proper destination.

Anyone have any ideas on this?

Mike Waychison


Current thread: