Mac addresses, as we know, are fundamental layer two addresses for the identification of Ethernet
nodes or wireless nodes or Bluetooth nodes.
So these Layer two addresses are often going to be addresses that are spoofed or maybe even something
like Gratuitous.
ARP gets an organization in trouble.
Gratuitous ARP is when a device will report its MAC address and IP address information, even when it
is not requested.
So it's going to be gratuitously offering this up on the network.
The Mac address itself is a 48 bit address and this numbering space is managed by the I Tripoli.
It's got an EU y 48 common name and also now we are moving to UI 64.
So I must admit that I meant to write on this slide UI 48 but that's okay because UI 64 is the recommended
next step when it comes to this addressing and UI 64 is already being done in IPV six.
So it's great to know about UI 64 as well, but we officially call the MAC address.
Right now, the UI 48 standard.
Now what's cool about this is Mac addresses are doled out to the big manufacturers of networking nodes
and networking equipment.
And so we have an organizational identifier portion.
When you look inside of a Wireshark capture, you will see the resolution of that organizational identifier
portion by Wireshark, and it'll show you in brackets, brackets indicating that Wireshark calculated
the value for you.
And so in the brackets will be the organizational identifier lookup for you, which is a nice handy
feature of Wireshark.
You can see at a glance, Oh, look, that's a Broadcom device that sent that packet.
There are many different representations of the Mac address that we will actually see in demonstration,
so be ready for this.
You might look at your Mac address on a Windows machine and it will be presented in one format.
You look at a mac address on a router and it'll be presented in a different format.
Something else I want you to know about Mac addresses is that you'll often hear this kind of overemphasis
about them being burned in to their devices, and that really makes it sound like the Mac address cannot
be changed.
But this simply isn't true on a Cisco router.
Great example.
You can easily go to that device and you can go into interface configuration mode and you can use some
type of a mac address command and you can set the Mac address that that interface will report.
So you can absolutely modify MAC addresses all over the place from the original burned in address that
might be on the hardware.
Let's keep in mind that since there this is simple name resolution that is going on when it comes to
the MAC address, to the IP address.
And ARP is a very simple process in protocol.
It is quite subject to poisoning attacks, spoofing attacks, denial of service attacks, all kinds
of crud.
But the great news is there's tried and true defenses now.
So a lot of systems now are very commonly locking down MAC addresses.
So your workstation at your headquarters is assigned a mac address.
The Ethernet port that it plugs into on the switch is locked down to that specific MAC address.
And then there are further protections against address learning happening happening to rapidly on that
port, which would indicate some kind of a denial of service attack.
So it really is impressive, the fundamental defenses that exist like port security, as I just described
it.
And there is also, of course, even more sophisticated mechanisms that can be applied higher up the
protocol stack to guard against any of these very simple, simplistic Mac address type of attacks.
We'll get into more specifics at layer two and issues with MAC addresses later on with specific scenarios.