enter image description here I was able to find the Teardrop Attack. However, there is another one but I couldn't explain it. It keeps getting the warning: Source MAC must not be a group address. Is this some sort of ARP spoofing to steal data?

Edit 1: Could there be a chance that a botnet auto-generate MAC address for packets but didn't work as expected?

capture file


Bit 0 of the first octet, 0D in this case, indicates single device or group. It's analagous to multicast at the IP level. If the first octet is odd, as in 0D, it indicates group.

If your application needs to send to multiple devices, it sends to a goup address.

It does not make any sense to originate from a group address.

This would be a poorly configured packet generator on your local network.

As to what it's trying to accomplish, I'm not sure. From the IP addresses, I'm guessing this is probably a VM based lab you're using.

  • This was indeed in VM lab. I'm think to go different way by ignore this warning and find another security problem. But couldn't find one so far. – 213 QHuyNguyen Oct 13 '19 at 1:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.