[unisog] Xbox: making up MAC 00:50:F2:* and IP address

Irwin Tillman irwin at princeton.edu
Tue Dec 4 18:30:40 GMT 2001

"Curtis Kline" <ckline at housing.ucsb.edu> wrote:

>One question... how did you determine that your 00:50:F2 traffic was
>coming from a single machine? Sure you don't just have a group of people
>trying to play xBox games across your net? I'm assuming 00:50:F2 is a
>legitimate prefix for xBox, since it is registered to MS.

I cannot be sure, but strongly suspect it's a single box, as the traffic 
(from 60 unique  MAC addresses) all appeared on one day on our student network, 
all in a single dormitory building.

Elliot Metsger <emetsger at jhu.edu> wrote:

>Could you post a couple hex dumps of the packets?  I'd be interested in 
>taking a look!

I will post once I have a packet capture.  (Right now all I have are
logs of the device hitting the IP egress filter.  It has
apparently been offline since I set up a sniffer.) 


More information about the unisog mailing list