Network with Multiple Host's all the same MAC Address??

[spyingeye]

Hey everyone! Long time user first time poster.

I came across something I could not find anything about online.

I was on a public network the other day and I did a quick "Host Scan" to see the [Mac Address and IP] of the other people on the network.

What I saw really confused me.

About 1,000 Hosts were on the network.

They had different IP Addresses but the same Mac Address.

I know that Mac Addresses are sometimes specific to brand or model and often repeat if there are the same "routers, bridges, etc..."

However this was at a hotel I was staying at and there were only 200 rooms and no way there could be 1000 hosts.

Is this a way to thwart network sniffing applications?

Maybe a spoofing technique to confuse network sniffing?

If so is there a work around?

Any info would be greatly appreciated!


- I also plan on releasing some neat tutorials not mentioned much online.

Thanks!

[nightlybuild]

I had the same thing happen to me. I sniffed the network and find a bunch of ip addresses with the same mac address. Is there any explanation to this?

[streaker69]

I had the same thing happen to me. I sniffed the network and find a bunch of ip addresses with the same mac address. Is there any explanation to this?

Yes, you can bind multiple IP addresses to the same interface. It's quite common.

Do you really think that all those webservers out there hosting hundreds of different sites have hundreds of NIC's installed in them?

[nightlybuild]

Yes, you can bind multiple IP addresses to the same interface. It's quite common.

Do you really think that all those webservers out there hosting hundreds of different sites have hundreds of NIC's installed in them?

Thanks for the reply. So say there are 10 computers, all ten of them connect to the same NIC, how do the computers know how to talk to each other since when I sniff, all the IP addresses that are up on that NIC have the same MAC address. It just doesn't make sense to me that they all show up the same. Can you please clarify?
Thanks again!


Edit: I think I may have found what seems to be happening in my case. I think that the whole network works through a Proxy ARP where all the computers contact the proxy ARP and it takes the data where it needs to go. Here's a link

h##p://en.wikipedia.org/wiki/Proxy_ARP