In message <[EMAIL PROTECTED]
com>, Adam Roach writes:
>Theodore Ts'o wrote:
>
>> Would it be possible to publish a list of MAC addresses that were
>> operating in ad-hoc or AP mode? If all of the happened to come from a
>> signle manufacturer, that might be a very interesting data point.
>
>A lot -- possibly even a majority -- of the cards I saw operating in
>ad-hoc mode were using mac address prefixes that aren't assigned
>to any manufacturer by the IEEE [1]. Many started with the octet "C0".
>I even saw a card in ad-hoc mode with a MAC address of FF:FF:FF::FF:FF:FF.
>
I saw some unicast TCP packets sent to MAC address FF:FF:FF::FF:FF:FF
-- I have no idea how that happened...
--Steve Bellovin, http://www.research.att.com/~smb
