[unisog] Strange things from our residence.

Jeff Bollinger jeff01 at email.unc.edu
Wed Oct 23 00:09:08 GMT 2002


Maybe he/she found this link:

http://www.ntfaq.com/Articles/Index.cfm?ArticleID=23256

Jeff

On Tue, 22 Oct 2002, Pete Hickey wrote:

> 
> SO we've had a weird problem (on a subnet) in one of our residences.
> It seems like people were gradually loosing connectivity.  What was
> happening is that someone was sending out ethernet packets with a
> source MAC address of FFFFFFFFFFFF..  A broadcast as the asource.
> 
> NOw, what the switch was doing (a bug IMO) was noting that this was
> the MAC associated with that port.  Then, all broadcasts were directed
> to that port, and not broadcast.  Arps would then stop working, new
> connections wouldn't DHCP, etc...
> 
> What I'm wondering, is what was he doing.  I want to capture the
> guy and torture him to find out, but I seem to be running into
> some resistence.
> 
> Did he just screw up, or is this some kind of (bungled?) way to do
> something nasty?
> 
> -Pete
> 

Jeff Bollinger
University of North Carolina
IT Security Analyst
105 Abernethy Hall
mailto: jeff_bollinger at unc dot edu



More information about the unisog mailing list