2

When doing forensics, I saw the same MAC-address being used by two different IP-addresses in a splunk logfile:

139...  4681.791993  Apple_5a:77:9b  Apple_69:38:cc  ARP  64    192.168.1.64 is at 00:1f:f3:5a:77:9b
133...  4380.593992  Apple_5a:77:9b  Apple_69:38:cc  ARP  64  169.254.90.183 is at 00:1f:f3:5a:77:9b

What does that mean?

  • One of those IPs in a private address space, this is probably the same machine. How did you acquire your scan info? – iainpb Mar 9 '17 at 11:33
  • from a log file, i am using splunk. – kaplangoz Mar 9 '17 at 11:35
  • 1
    @iain Both are Private IPs. The second is APIPA Adress that gets selected if no DHCP or static IP is present – architekt Mar 9 '17 at 11:57
  • @MartinFischer I have learned something new! – iainpb Mar 9 '17 at 12:17
8

I would read your logs as follows:

  • 192.168.1.64 is the IPv4 address the physical interface with MAC 00:1f:f3:5a:77:9b is using. I would tend to assume the IP was handed out via DHCP, but you would see a similar IP <-> MAC map if it was statically assigned (you simply would not be likely to see it from a DHCP server)

  • 169.254.90.183 is a link-local address (https://en.wikipedia.org/wiki/Link-local_address), which in effect means it is an autoconfigured address the machine assigned to itself when all other IP assignment mechanisms failed (typically, this would happen when a node cannot get a DHCP assignment, potentially because the DHCP server has no free IPs to hand out, or because it is busy).

If the first two columns in your output are a reasonable proxy for timestamps, I would take all this to mean DHCP failed temporarily, before working again and providing the host with an address.

As a link-local address, traffic from 169.254/16 will not leave the broadcast domain, so in a forensic context, unless something happened within the broadcast domain, I would disregard it.

There is one specific use of this range that would possibly be worthwhile worrying about, which is a host announcing itself as 169.254.169.254 within a cloud environment (see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)

  • Thanx for clear answer – kaplangoz Mar 9 '17 at 13:03
  • @kaplangoz don´t forget to accept the answer (check marker below the rating of this answer) – architekt Mar 9 '17 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.