enter image description here I was able to find the Teardrop Attack. However, there is another one but I couldn't explain it. It keeps getting the warning: Source MAC must not be a group address. Is this some sort of ARP spoofing to steal data?

Edit 1: Could there be a chance that a botnet auto-generate MAC address for packets but didn't work as expected?

capture file

closed as unclear what you're asking by multithr3at3d, MechMK1, Conor Mancone, Graham Hill, DoubleD Oct 17 at 14:52

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


Bit 0 of the first octet, 0D in this case, indicates single device or group. It's analagous to multicast at the IP level. If the first octet is odd, as in 0D, it indicates group.

If your application needs to send to multiple devices, it sends to a goup address.

It does not make any sense to originate from a group address.

This would be a poorly configured packet generator on your local network.

As to what it's trying to accomplish, I'm not sure. From the IP addresses, I'm guessing this is probably a VM based lab you're using.

  • This was indeed in VM lab. I'm think to go different way by ignore this warning and find another security problem. But couldn't find one so far. – 213 QHuyNguyen Oct 13 at 1:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.