search

v-byte-cpu / sx

:vulcan_salute: Fast, modern, easy-to-use network scanner
MIT License
1.44k stars 109 forks source link

Many duplicate MAC address #117

Closed sourcerorsupreme closed 2 years ago

sourcerorsupreme commented 2 years ago

I'm seeing 100+ IP addresses sharing a Mac address during an ARP scan.

I check my managed switch and those do not appear.

Is this an issue with my network or a problem with the way sx is scanning ARP?

v-byte-cpu commented 2 years ago

Hi @sourcerorsupreme it is hard to say what causes this behavior, try recording all arp packets in wireshark during scan and check

sourcerorsupreme commented 2 years ago

@v-byte-cpu Thank you very much. I'll attempt to do so and see whats causing the issue.

I will update this issue within the next few days if it turns out to not be user issue on my part.

sourcerorsupreme commented 2 years ago

This is not a problem with sx; however, one of the servers I have is responding with hundreds of MAC addresses it does not have. I am investigating this further as it is a problem on my side.

Thank you again for your guidance in the matter.

sourcerorsupreme commented 2 years ago

For anyone else that may experience this issue in the future. Ensure that the systems in your network are not using Proxying ARP as that will cause this issue.

Thanks for this great tool, truly appreciate your time.