[AusNOG] The occurrence of duplicate MAC addresses

[James Andrewartha]

On Fri, 8 Feb 2013, Tom Berryman wrote:

> Actually bad luck to both guy #1 and #2 really- though you would 
> *presume I wouldn't be larger vendors "recycling" their MAC allocation, 
> but the smaller vendor less likely to have their hardware located at a 
> large peering point... I have suspected -for 12 months or so- iPads to 
> do this presenting issues on large scale L2 deployments when the units 
> were purchased in bulk, i.e. a secondary school purchasing 600 or so in 
> 1 order and connecting to a campus wide L2 domain.... Anyone else out 
> there experience this with iPads?

You're possibly seeing http://en.wikipedia.org/wiki/Bonjour_Sleep_Proxy in 
effect. When a device goes to sleep, other fruity devices will ARP spoof 
and reply to mDNS queries, then wake it up if someone sends actual traffic 
to a Bonjour advertised service. I've got arpwatch logs of it happening 
with Apple TVs, and there was something funny going on on the iPad VLAN, 
but whether it was stale leases from other networks or what I'm not sure.

-- 
# TRS-80              trs80(a)ucc.gu.uwa.edu.au #/ "Otherwise Bub here will do \
# UCC Wheel Member     http://trs80.ucc.asn.au/ #|  what squirrels do best     |
[ "There's nobody getting rich writing          ]|  -- Collect and hide your   |
[  software that I know of" -- Bill Gates, 1980 ]\  nuts." -- Acid Reflux #231 /