-   Linux - Newbie (
-   -   Different MAC router when scanning with nmap (

wez 06-05-2012 06:09 AM

Different MAC router when scanning with nmap
I'm doing some testing on my network and having the following outcome for
sudo nmap -sV -vv -PN

80/tcp open http Linksys WAG200GB WAP http config
443/tcp open tcpwrapped
1863/tcp open tcpwrapped
1864/tcp open tcpwrapped
4443/tcp open tcpwrapped
5190/tcp open tcpwrapped
5566/tcp open tcpwrapped
49152/tcp open http Intel UPnP reference SDK httpd 1.2 (UPnP 1.0, platform Linux 2.4.17_mvl21-malta-mips_fp_le)
MAC Address: xx:xx:xx:xx:80:32 (Cisco-Linksys)
Service Info: OS: Linux; Device: WAP

When I check the status in my Linksys router (thru web-interface), I see the following:

MAC Address: xx:xx:xx:xx:80:33 For gateway

Tought the mac was a "unique identifier" for the router.
Is it correct that th're two MAC's, One for local one for gateway? Or is it spoofed?

Thanks in advance!

evo2 06-05-2012 10:58 PM


different network devices will have different mac addresses. Presumably you are looking at one of the internal interfaces when you run nmap, and are looking at the external interface when you use the web interface.


AwesomeMachine 06-05-2012 11:00 PM

Yes, there are two MACs. But one is only in reference to the unique MAC. You can usually change the nonunique one to anything you want.

wez 06-06-2012 03:28 PM

Thanks, Seniors!!


All times are GMT -5. The time now is 09:54 AM.