detect mac address spoofing

bensky · 03-11-2005, 04:14 AM

Hi,

I want to write a small programm to detect if a user has tried to spoof his mac address. The program will run directly on the workstation with the possibly spoofed MAC address.

I tried already the following to read the Mac Address:

Code:

int main( int argc, char *argv[] )  { 
  int s;  struct ifreq buffer; 
  s = socket(PF_INET, SOCK_DGRAM, 0);   
  memset(&buffer, 0x00, sizeof(buffer));  
  strcpy(buffer.ifr_name, "eth0");  
  ioctl(s, SIOCGIFHWADDR, &buffer); 
  close(s);   

  for( s = 0; s < 6; s++ )  {  
    printf("%.2X ", (unsigned char)buffer.ifr_hwaddr.sa_data[s]);
  }    
  
  printf("\n");  
  return 0;  
}

But this will always return the spoofed Mac address in case it is changed.

Now my question, how can I read the mac address directly from the lan card ROM? I guess there should be a code snipet in the kernel which I could re-use to do so!

Thanks in advance for any input on this!

Ben

newpenguin · 03-13-2005, 12:23 AM

i know this is not answer of your question, but may be usefull for some one.

because thats a big issues these days.

a common solution to this problem is to bind a specific pair of mac/ip to a switch port, if your switch supports it.

however if you have a linux router you can use iptables to allow specific pairs of mac/ip and then deny all.