I'm surprised nobody's mentioned the magic letters that make all the difference when dealing with MAC addresses: A, R, and P. (Address Resolution Protocol.)

Disclaimer: networking isn't my field. Take this node with a pillar of salt.

ARP is used on Ethernet networks to map between 32-bit IP (Internet) addresses and 48-bit MAC (hardware) addresses; it's how the router figures out that, hey, 209.foo.bar.baz is this computer, not that one. The short version, IIRC, is that the router, upon receiving a packet to 209.foo.bar.baz, broadcasts an ARP packet to its local Ethernet, saying "Hey, which network interface is 209.foo.bar.baz?" The appropriate computer is supposed to reply with another ARP packet, saying "I am, and my MAC address is 00:00:aa:bb:cc:dd" The router caches that MAC address, and sends all packets addressed to 209.foo.bar.baz to the local MAC 00:00:aa:bb:cc:dd.

(I think. I'm skimming TCP/IP Illustrated vol. 1 as I write this, but there's no guarantee that I'm properly interpreting everything.)

So to spoof a MAC address, you need to come up with the "Hey, I'm 209.foo.bar.baz" packet on the local net. The problem is, ARP is usually handled by the network card driver. On the other hand, you may be able to hook into a firewall/packet filtering program to spoof ARP packets.

ARP is described in RFC 826.

Of course, all this really lets you do is spoof multiple IPs from a single MAC address. To set MAC addresses, I direct you to the arp(8) man page on 4.3BSD and later Unix systems, or to Google for others. (There seems to be an arp command on Windows 2000, according to my Google search; not having Win2k, I wouldn't know.)

I suspect that it's easier to make system calls (to such beasts as ifconfig and arp) inside a Perl script than it is to forge packets and mung hardware MAC addresses via Perl modules.

--
:wq

In reply to Re: How can I simulate multiple IP/MAC combinations on one computer? by FoxtrotUniform
in thread How can I simulate multiple IP/MAC combinations on one computer? by apprentice

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.