Results 1 to 2 of 2

Thread: Wireshark shows mixed real/fake MAC

  1. #1
    Just burned his ISO
    Join Date
    Jul 2009
    Posts
    6

    Default Wireshark shows mixed real/fake MAC

    I've been trying to find some information on this. I had Wireshark running on my laptop and on our network was my partners MacBook & a Windows PC running and even though I changed my MAC and checked it was changed (it was) after a little while I saw:

    192.168.1.4 224.0.0.251 MDNS Standard query response PTR _workstation._tcp.local PTR laptopnet [real mac]._workstation._tcp.local
    Then I noticed that Wireshark's capture options were showing my real MAC yet when I ran a capture it was mainly showing my fake MAC apart from a few times it showed my real MAC.

    Any ideas?

  2. #2
    Very good friend of the forum Virchanza's Avatar
    Join Date
    Jan 2010
    Posts
    863

    Default

    I can give you a theory. It's just a theory though.

    Some people think that a network card simply has a MAC address, as if it's something inherent and permanent in the network card.

    Other people see a MAC address as something more fluidic; for instance, you could think of a network card's MAC address as "the source MAC address it puts in the frames it sends out".

    I could well imagine that a particular network card, when queried by the operating system as to its MAC address, will always give its original MAC address that it was assigned in the factory. This doesn't mean to say though that the network card is sending out Ethernet frames using that MAC address as the source address.

    So basically my theory is this: You changed your MAC address and it was successful, i.e. the network card is using the new MAC address as the source of the frames it sends. However, when the operating system queries the MAC address of the network card, the network card always tells it its original MAC.

    So when you go to open a new capture in Wireshark, it queries your network card for its MAC address, this might be why you're seeing the original MAC address. However once the capture starts, you're seeing the new MAC address in the packet capture box because that's the MAC that's being used for sending frames.
    Ask questions on the open forums, that way everybody benefits from the solution, and everybody can be corrected when they make mistakes. Don't send me private messages asking questions that should be asked on the open forums, I won't respond. I decline all "Friend Requests".

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •