MAC address intrepretation?

[802.11]

from dmesg


1. Firewall:IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:00:1c:d6:1e:e3:08:00 SRC=xxx.194.206.64 DST=yyy.194.206.255 LEN=78 TOS=0x00 PREC=0x00 TTL=128 ID=43701 PROTO=UDP SPT=137 DPT=137 LEN=58

2. is "mac" means my NIC 's mac or the browser's mac?

Thanks.

[chrism01]

The MAC address is a hardwired address, express in hex, that is set in your ethernet card by the manufacturer.
All Ethernet cards are guaranteed to have a unique value, even across manufacturers.

[802.11]

MAC=ff:ff:ff:ff:ff:ff:00:00:1c:d6:1e:e3:08:00

is "mac" means my NIC 's mac or the browser's mac ?

[mdwatts]

# ifconfig eth0

eth0 Link encap:Ethernet HWaddr 00:20:AF:DB:71:F3
inet addr:192.168.1.4 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:62269 errors:0 dropped:0 overruns:0 frame:0
TX packets:61068 errors:0 dropped:0 overruns:0 carrier:0
collisions:0

[seabass55]

MAC address is hardware set but there were cards you could manually set the mac address on. On novell clients I used to do this when my HS computer teacher would restrict me to one machine so he could "watch" me. The config files of the cards allowed me to set the mac address to my one machine I was restricted to. Don't know if you can do this anymore...this was DOS 5-6 days.

Your browser doesn't have a MAC address..just a piece of hardware.

Sebastian

[bwkaz]

Originally posted by 802.11
MAC=ff:ff:ff:ff:ff:ff:00:00:1c:d6:1e:e3:08:00

is "mac" means my NIC 's mac or the browser's mac ? As was said, a browser doesn't have a MAC address. However, what you've posted is way too long to be a MAC address on its own... it looks like it might be something similar to the IP address / netmask setup, perhaps. Though MAC addresses can't be subnetted (that I know of, anyway...), so that doesn't make too much sense... hmm.

MAC addresses are 6 bytes long, so I'd take the last 6 bytes of this (that is, 1c:d6:1e:e3:08:00) and see if it matches what ifconfig -a tells you. If it does, then it's your MAC address. If not, it's the remote computer's.

ff:ff:ff:ff:ff:ff is not a valid MAC address, either, I don't think. Some of the bits up in the higher bytes mean specific things (there is one bit up there, that if it's set, it means the MAC address in question was never assigned to a NIC manufacturer), and all of them are set...

[ovf]

I think it's a netbios request.

MAC=
ff:ff:ff:ff:ff:ff = destination MAC address = broadcast (all nodes will receive it)

:00:00:1c:d6:1e:e3: = source MAC address - some node on the net

08:00 = packet type = IP

SRC=xxx.194.206.64
DST=yyy.194.206.255
LEN=78 TOS=0x00
PREC=0x00
TTL=128
ID=43701
PROTO=UDP

SPT=137 = IP source port = netbios name service (according to rfc1700)

DPT=137 = IP destination port = netbios name service (according to rfc1700)

LEN=58