Subject: RE: IETF58 - Network Facts

From: Adam Roach <[email-masked]>
Date: Thu, 20 Nov 2003 11:04:20 -0600

Theodore Ts'o wrote:

> Would it be possible to publish a list of MAC addresses that were
> operating in ad-hoc or AP mode?  If all of the happened to come from a
> signle manufacturer, that might be a very interesting data point.

A lot -- possibly even a majority -- of the cards I saw operating in
ad-hoc mode were using mac address prefixes that aren't assigned
to any manufacturer by the IEEE [1]. Many started with the octet "C0".
I even saw a card in ad-hoc mode with a MAC address of FF:FF:FF::FF:FF:FF.

/a

[1] According to http://standards.ieee.org/regauth/oui/oui.txt
    which is updated daily.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 20 Nov 2003 12:30:02 -0500

In message <[email-masked].
>I even saw a card in ad-hoc mode with a MAC address of FF:FF:FF::FF:FF:FF.

I saw some unicast TCP packets sent to MAC address FF:FF:FF::FF:FF:FF 
-- I have no idea how that happened...

		--Steve Bellovin, http://www.research.att.com/~smb