Re: [Ethereal-users] Weirdness in CablemodemLand?

[James Courtier-Dutton <James@xxxxxxxxxxxxxxxxxxxx>]

John E. Mayorga wrote:

> Now, when I press "h" to tell Hunt to dump the MACs it
> collected, I get:
>
> --- mac table ---
> 24.127.52.1              00:B0:8E:F7:3C:54
> 24.127.52.10             00:01:02:84:77:E2
> --- mac disc. daemon --- rcvpkt 2425, free/alloc 63/64
> ---M---
>
>
> Strange, only two MAC addresses. If I poke through the
> traffice that I had generated with the "nmap -sP
> 24.127.52.*" using Ethereal, any responses from the
> machines nmap was communicating with (mostly http
> responses) gives the following Layer 2 info:
>
> For "Ethernet II" it gives the MAC of the router (and
> it resolves to the router's IP on the same line)
>
> For the IP layer on the "Internet Protocol" line it
> gives Source: as the machine nmap was communicating
> with at the time.
>
> Helpful hints: It was explained to me during the
> installation that I was the only one on my segment,
> which is believable, considering my location. My
> network mask is: 255.255.254.0
>
> I am including an attachment of the Ethereal log of
> another "nmap 24.127.52.*", done about 15 minutes
> after the first.
>
> > From this:
> 1) Can anyone give me clues about how my cablemodem
> network configuration might be layed out (by at&t
> @home)?
>
> 2) Can anyone tell me why the MAC addresses reported
> by Ethereal are all that of the router?
>
> 3) Is there any strangeness going on here, or am I a
> bonehead. The latter answer is OK if you explain why.
> :-)
>
> Thanx,
>
> John
>
> P.S. I'll even include a subject header this time...
>
>
>  

Have you heard about Proxy-ARP ?
I think that is what is happening here.
Cheers
James