0

If I connect to my VPN and then run arp -a the MAC address of my router changes to 00:00:00:00:00:02. Is this normal behaviour? What is the reasoning behind this?

Furthermore a MAC address spoofing is only of real concern when there are more than one devices on the network, and they try to become the MITM correct?

Improve this question
5
  • "... when there are more than one devices on the network ..." - if there is only a single device it cannot even be called a network, it is a device only.
    – Steffen Ullrich
    Commented Nov 13, 2020 at 8:16
  • Did you know the answer to my actual question?
    – joshnow
    Commented Nov 13, 2020 at 15:08
  • And the reason i word the question that way, is cause there could have been more than one device connected at one time, but at the moment my machine connected to the VPN it is the only one on the network
    – joshnow
    Commented Nov 13, 2020 at 15:13
  • Very likely there is at least the router in the network - which is also a network device. Apart from that: what OS you are using and what kind of VPN. And what is the complete output of arp -a?
    – Steffen Ullrich
    Commented Nov 13, 2020 at 16:11
  • I'm on Ubuntu 20.04, The VPN is expressVPN which uses an open-source implementation of IKEv2 and this is the complete output: ? (192.168.0.1) at 00:00:00:00:00:02 [ether] on wlp1s0
    – joshnow
    Commented Nov 13, 2020 at 16:32

1 Answer 1

Reset to default
2

When you spin up a VPN tunnel, the VPN tunnel becomes your new primary route. If the router address remained as your physical router MAC, then you would not be routing traffic through the VPN, and you would not be protected. The virtual router your VPN sets up is using the synthetic MAC address 00:00:00:00:00:02. The change you're seeing is the correct and expected behavior when activating a VPN.

And you are correct, MAC spoofing requires an attacking device on the same LAN. What you are seeing is not MAC spoofing, regardless.

Improve this answer
4
  • +1. This is what I thought, but I wasn't sure. Out of curiosity, if the VPN is configured for split-tunneling, would this answer still apply?
    – mti2935
    Commented Nov 13, 2020 at 16:49
  • No, if it is split-tunneling, the default would remain the hardware router but specific routes for the VPN-targeted subnets would be made with the virtual MAC as their destination.
    – gowenfawr
    Commented Nov 13, 2020 at 16:57
  • Is this behavior in the answer specific to IPsec? I have not seen this before with other protocols.
    – multithr3at3d
    Commented Nov 13, 2020 at 23:50
  • @multithr3at3d it applies to IPSec tunnel mode, not IPSec transport mode (but the latter is pretty rare to run across). I'm sure other protocols may handle it differently...
    – gowenfawr
    Commented Nov 14, 2020 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .