Am I causing problems?

[kakariko81280]

I am a guest on a wireless network tonight and, although I had the WEP key from the last time I was here, the owner has added MAC address filtering since then.

Rather than faff with the security settings of the network I snagged a few packets and copied the MAC address off another computer that was using the network at the time.

My thinking is that two physical devices with the same MAC address would appear to be one physical device with two IPs, then each computer would discard the packets with the wrong IP.

Both computers were online at the same time and seemed to have no problems. My question is, was I causing trouble and the computers were just coping with it, or is this a perfectly acceptable thing to do?

Chris...

[bigtomrodney]

I'm surprised it worked actually. MAC address is really only used on the LAN level so I would have thought that DHCP might have tried to give you the same IP address as the other PC. If it works it works but I'm sure you will get some weirdness along the way.

[meton_magis]

thats actualy pretty cool. i know that is to some degree how arp poisoning starts, but i've never heard of it used to trick mac filtering.

[kakariko81280]

I would have thought that DHCP might have tried to give you the same IP address as the other PC.

By the time my computer had booted enough for me to fiddle the network settings, it had already tried and failed to use DHCP so I set things up manually. After the other computer was turned off I went back to dhcp and it did give me the same IP, and that would have been a big (temporary) problem had both machines been on at once. I just got lucky there.

meton_magis, this was easier than arp poisoning.

# ifconfig eth0 hw ether <MAC address>

is all that is needed.

I had always thought that getting round MAC address filtering like this would require the cloned PC to be offline, but it seems not to be the case.

Chris...

[kakariko81280]

Some quick research (which I should have done first, but where's the fun in that) turned up this article on mac address spoofing which concludes that a cloned mac address can cause problems because if one machine disassociates from the AP then the other will get booted at the same time. I don't see this a big problem though, because it can re-associate quickly enough to be unnoticeable.

WPA is more serious because when the second client authenticates, the re-keying involved kicks the first client off the network.

Still, it's another reason not to rely on WEP and MAC filtering.

Chris...