Interesting WIFI MAC address problem?

I am running NetStumber to see what I can pick up locally. It picks up
WIFI enabled mobile phones and other like equipment as they pass my
machine as well as displaying fixed Peer and AP's.

Interestingly I noticed lots of Peer devices with the same name (no
longer within range) with different MAC addresses. After some
investigation I found that these Peer devices (what ever they were)
seem to be the same device each time they come into range of
NetStumbler and yet report a different MAC address each time.

I thought you required a fixed MAC address for WIFI? This helps
security by MAC filtering. Why are these devices changing MAC address
each time I see them? How are they doing it and why? Anyone ever seen
this before or know why?


------------------------------------------------------------------------
View this thread: http://www.wirelessforums.org/showthread.php?t=24128
http://www.wirelessforums.org

"Bash" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
>
> I am running NetStumber to see what I can pick up locally. It picks up
> WIFI enabled mobile phones and other like equipment as they pass my
> machine as well as displaying fixed Peer and AP's.
>
> Interestingly I noticed lots of Peer devices with the same name (no
> longer within range) with different MAC addresses. After some
> investigation I found that these Peer devices (what ever they were)
> seem to be the same device each time they come into range of
> NetStumbler and yet report a different MAC address each time.

How did you determine they were the same device.
As for the different Mac Addresses, changing the Mac is not a big deal.

>
> I thought you required a fixed MAC address for WIFI? This helps
> security by MAC filtering.

While MAC filtering is nice and easy, and would lead one to believe it is a
good solution, because of the fact that MAC addresses can be changed, and
that MAC addresses are sent in the clear, it is not a very good security
tool.
For a home network just allowing your own Mac addresses is a good start, in
any kind of public network, mac filtering is easily subverted.

> Why are these devices changing MAC address
> each time I see them? How are they doing it and why? Anyone ever seen
> this before or know why?
>
>
> ------------------------------------------------------------------------
> View this thread: http://www.wirelessforums.org/showthread.php?t=24128
> http://www.wirelessforums.org
>

Bash <(E-Mail Removed)> hath wroth:

>
>I am running NetStumber to see what I can pick up locally. It picks up
>WIFI enabled mobile phones and other like equipment as they pass my
>machine as well as displaying fixed Peer and AP's.

Are you sure you're running Netstumbler 0.4? It does not pickup
client radios, such as Wi-Fi enabled cell phones (like my XV6700), and
wireless clients such as notebooks. What are you really doing?

>Interestingly I noticed lots of Peer devices with the same name (no
>longer within range) with different MAC addresses. After some
>investigation I found that these Peer devices (what ever they were)
>seem to be the same device each time they come into range of
>NetStumbler and yet report a different MAC address each time.

Oh that bug. See:
<http://www.nmrc.org/pub/advise/20060114.txt>
<http://blogs.chron.com/techblog/archives/2006/09/free_public_wif.html>

It was fixed about a year ago with an MS update, but many users don't
seem to believe in updates.
<http://support.microsoft.com/kb/917021>

>I thought you required a fixed MAC address for WIFI? This helps
>security by MAC filtering. Why are these devices changing MAC address
>each time I see them? How are they doing it and why? Anyone ever seen
>this before or know why?

--
Jeff Liebermann (E-Mail Removed)
150 Felker St #D http://www.LearnByDestroying.com
Santa Cruz CA 95060 http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558