Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Under what circumstances could two completely different machines receive packets at the same class C IP address that is not within the IANA-reserved private IPv4 network ranges?

share|improve this question

closed as not a real question by Iszi, Jeff Ferland, Steve, this.josh, Hendrik Brummermann Oct 19 '11 at 7:05

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Is this really hypothetical? Or, is there a real-life scenario involved here? The FAQ says "You should only ask practical, answerable questions based on actual problems that you face". If this is an actual issue, much more detail would be useful. If you can reproduce the situation with non-sensitive data, a packet capture of the incident could be helpful as well. – Iszi Oct 19 '11 at 1:28
Seems more like a ServerFault question. – Steve Oct 19 '11 at 1:35
@Iszi - wow, IMHO that's inane, thanks for pointing that out. The "actual problems that you face" rule makes sense for virtually every stack exchange other than IT security - a field which is based on developing theoretical scenarios to prevent events that haven't happened yet. I should definitely have made this more answerable, but the idea that it should be summarily dismissed because it's hypothetical implies that this stackexchange should be renamed IT forensics, not IT security. – Peter Nore Oct 24 '11 at 22:27

It would help if you were more clear about the topology of what you're discussing, but on the face of it my first guess is that your switch was forwarding packets to multiple ports and figured it out after a little while.

1) More info from above helps. Packet dumps really help.

2) ?

3) Dependent on 2.

share|improve this answer
The question sounds like it could also be describing a Windows NLB compatible switch layout, or any form of port mirroring. – TristanK Oct 19 '11 at 1:42

This is not necessarily a failure condition that you are describing. In fact, depending on your environment this may be completely normal behavior.

My first assumption would be a DHCP lease transition, this is common in highly utilized pools. As such I would go through the logs looking for the appropriate EXPIRE/RELEASE/DISCOVER events and build out a timeline.

Another option could be the fail-back condition of a switch. When a switch does not know which port a MAC address can be found on, it transmits the packet out all switches. In other words, reverting to hub behavior. Granted, this would result in all systems receiving packets for the given system. However, this is often detected by accident because one individual happens to start a packet capture before the MAC is learned by the switch. This most often occurs when dealing with UDP packets, such as a syslog receiver. When the target receives packets consistently, but rarely transmits. As such, the CAM entries age out.

If neither of those options pan out, then I would assume malicious intent. Arp poisoning would be the most likely candidate. How one goes about finding the target depends heavily , exclusively?, upon your infrastructure and what network management/monitoring tools you have in place.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.