Hacker News Reader

Comment by peterwwillis | Hacker News Reader

Fun fact: MAC addresses are not unique.

Neither are blue eyes, nor height, etc

I remember one occasion ~2002 where a new NIC with a duplicate MAC addresses took down our DC - the whole IT team was floundering for hours before the cause was discovered after I noticed it in Snort logs. I have a strong interest in infosec, and I'd fought hard to get that Snort tap installed only a couple of weeks previously :)

Fun fact 2: you can change the MAC addresses on most systems.

My old university had a badly managed WLAN network that everyone could use. The physical network used a MAC whitelist, so getting a good connection meant replacing the MAC adress of your notebook with that of a whitelisted PC.

Sure, they can be spoofed, but do nic vendors try to keep them unique, or do they reuse them from a pool, like after the card is 10+ years old?

"It depends."

Sometimes vendors would burn duplicates by accident. Sometimes they would simply run out and production would loop (there's "only" 16.7mil addrs per manufacturer prefix). Sometimes they print the same run in different geographical areas, because the MAC only matters in a broadcast domain. Often they just wouldn't keep track of what they assigned.

I just think it's funny to realize that people read "unique (to a broadcast domain)" and assumed that could mean "unique (everywhere)" because it's a really big number.

iOS spoofs them, right?

IIRC, it spoofs the MAC address when searching for available networks, but does not spoof the MAC address when connecting/connected.

Reply on news.ycombinator.com