2

When doing forensics, I saw the same MAC-address being used by two different IP-addresses in a splunk logfile: 

139...  4681.791993  Apple_5a:77:9b  Apple_69:38:cc  ARP  64    192.168.1.64 is at 00:1f:f3:5a:77:9b
133...  4380.593992  Apple_5a:77:9b  Apple_69:38:cc  ARP  64  169.254.90.183 is at 00:1f:f3:5a:77:9b

What does that mean?

Improve this question
4
  • One of those IPs in a private address space, this is probably the same machine. How did you acquire your scan info?
    – iainpb
    Commented Mar 9, 2017 at 11:33
  • from a log file, i am using splunk.
    – user134404
    Commented Mar 9, 2017 at 11:35
  • 1
    @iain Both are Private IPs. The second is APIPA Adress that gets selected if no DHCP or static IP is present
    – architekt
    Commented Mar 9, 2017 at 11:57
  • @MartinFischer I have learned something new!
    – iainpb
    Commented Mar 9, 2017 at 12:17

1 Answer 1

Reset to default
8

I would read your logs as follows:

  • 192.168.1.64 is the IPv4 address the physical interface with MAC 00:1f:f3:5a:77:9b is using. I would tend to assume the IP was handed out via DHCP, but you would see a similar IP <-> MAC map if it was statically assigned (you simply would not be likely to see it from a DHCP server)

  • 169.254.90.183 is a link-local address (https://en.wikipedia.org/wiki/Link-local_address), which in effect means it is an autoconfigured address the machine assigned to itself when all other IP assignment mechanisms failed (typically, this would happen when a node cannot get a DHCP assignment, potentially because the DHCP server has no free IPs to hand out, or because it is busy).

If the first two columns in your output are a reasonable proxy for timestamps, I would take all this to mean DHCP failed temporarily, before working again and providing the host with an address.

As a link-local address, traffic from 169.254/16 will not leave the broadcast domain, so in a forensic context, unless something happened within the broadcast domain, I would disregard it.

There is one specific use of this range that would possibly be worthwhile worrying about, which is a host announcing itself as 169.254.169.254 within a cloud environment (see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)

Improve this answer
2
  • Thanx for clear answer
    – user134404
    Commented Mar 9, 2017 at 13:03
  • @kaplangoz don´t forget to accept the answer (check marker below the rating of this answer)
    – architekt
    Commented Mar 9, 2017 at 16:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .