[unisog] Strange things from our residence.

Daniel MacKay Daniel.MacKay at Dal.Ca
Wed Oct 23 00:27:46 GMT 2002


We had exactly the same thing in Physics.  I had an alarm go off that 
all the IP numbers were in use.  Imagine my surprise when they were 
all in use by the same hardware address, all F's.

Unfortunately the machine was found and dismantled before we could do 
an autopsy on it.  The network administrator there thinks that it is 
a hardware or software fault rather than malice.

At 15:26 -0400 02/10/22, Pete Hickey wrote:
>SO we've had a weird problem (on a subnet) in one of our residences.
>It seems like people were gradually loosing connectivity.  What was
>happening is that someone was sending out ethernet packets with a
>source MAC address of FFFFFFFFFFFF..  A broadcast as the asource.
>NOw, what the switch was doing (a bug IMO) was noting that this was
>the MAC associated with that port.  Then, all broadcasts were directed
>to that port, and not broadcast.  Arps would then stop working, new
>connections wouldn't DHCP, etc...
>What I'm wondering, is what was he doing.  I want to capture the
>guy and torture him to find out, but I seem to be running into
>some resistence.
>Did he just screw up, or is this some kind of (bungled?) way to do
>something nasty?
>Pete Hickey               |                         |"It runs like x, where
>Communication Services    | Pete at mudhead.uottawa.CA | x is something unsavory"
>University of Ottawa      |                         |
>Ottawa,Ont. Canada K1N 6N5|  (613) 562-5800x1008    | -- Prof. Romas Aleliunas

Daniel MacKay                           Daniel.MacKay at Dal.Ca
Network Services Manager                +1.902.494.danm
Dalhousie University, Halifax, Nova Scotia, Canada

More information about the unisog mailing list