I fear this is some kind of basic issue I misunderstand, but am curious how this can occur.
I have Lumos fiber (now T-Mobile) and an OPNsense firewall. For unrelated reasons I captured the WAN port, all packets, not in promiscuous mode, and I see packets where the from and two address are both not mine, and the MAC address IS mine, and I do not understand how they got there.
They are ignored by the firewall (or blocked probably) but my question is one of basic understanding – how do they come there?
I have a static IPv4 address (they do not offer IPv6), and all of these packets are in apparently random subnets unrelated to mine (mine starts with 66.x.x.x). I would expect them to never reach my router, it’s not like I am a default gateway for anything (but myself). And they are unicast, and they have my correct (masked in the image) MAC address.
I guess something very local (sharing the last hop) could be spoofing my MAC address but that just doesn’t seem all that likely, and I don’t see how it would be effective as the source addresses almost certainly are not local.
Below is just one of those packets captured. There seem to have little in common other than generally being a SYN packet, having my correct MAC address, and being from and two an IP that has no relation to me.
They are not actually affecting me, they have a tiny volume (and I have a 2g link), they are not making it through the firewall. I’m not trying to “fix” them.
I am trying to understand them.
Linwood
