Nmap - 具有相同 MAC 地址的多台主机

Question

我在我的本地网络上使用 nmap 并看到 sudo nmap 192.168.1.0/24 的输出有多个具有相同 MAC 地址的主机。

Nmap scan report for 192.168.1.120
Host is up (0.13s latency).
MAC Address: B6:B0:24:0F:58:49 (Unknown)
Nmap scan report for 192.168.1.185
Host is up (0.018s latency).
MAC Address: B6:B0:24:0F:58:49 (Unknown)
Nmap scan report for 192.168.1.201
Host is up (0.060s latency).
MAC Address: B6:B0:24:0F:58:49 (Unknown)
Nmap scan report for 192.168.1.202
Host is up (0.060s latency).
MAC Address: B6:B0:24:0F:58:49 (Unknown)
Nmap scan report for 192.168.1.204
Host is up (0.063s latency).
MAC Address: B6:B0:24:0F:58:49 (Unknown)

在什么情况下会发生这种情况？我四处搜索但没有找到任何资源。

对其中一台主机进行 tcp 端口扫描后，我看到以下内容：

Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-22 18:20 CDT
Nmap scan report for 192.168.1.185
Host is up (0.0083s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
20002/tcp open  commtact-http
MAC Address: B6:B0:24:0F:58:49 (Unknown)

我有 read from this post 它可能是一个 wifi 扩展器，但我不希望 ssh 端口在上面打开。

编辑：

我认为如果这是一个 wifi 扩展器，如果扩展器具有某种远程访问以及登录页面，则打开 ssh、http 和 commtact 是有意义的。运行nmap -p 80 --script http-auth-finder 192.168.1.185输出：

PORT   STATE SERVICE
80/tcp open  http
| http-auth-finder: 
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.1.185
|   url                                                               method
|   http://192.168.1.172:80/locale/language.js                        HTTP: Server returned no authentication headers.
|   http://192.168.1.172:80/themes/default/css/perfect-scrollbar.css  HTTP: Server returned no authentication headers.
|   http://192.168.1.172:80/js/su/language.js                         HTTP: Server returned no authentication headers.
|   http://192.168.1.172:80/themes/default/css/total.css              HTTP: Server returned no authentication headers.
|   http://192.168.1.172:80/js/libs/respond.min.js                    HTTP: Server returned no authentication headers.
|   http://192.168.1.172:80/js/su/frame.js                            HTTP: Server returned no authentication headers.
|   http://192.168.1.172:80/js/su/widget.other.js                     HTTP: Server returned no authentication headers.
|   http://192.168.1.172:80/themes/default/css/total.ie8.css          HTTP: Server returned no authentication headers.
|   http://192.168.1.172:80/js/su/su.fun.js                           HTTP: Server returned no authentication headers.
|   http://192.168.1.172:80/js/su/widget.form.js                      HTTP: Server returned no authentication headers.
|   http://192.168.1.172:80/themes/default/css/base.css               HTTP: Server returned no authentication headers.
|   http://192.168.1.172:80/js/app/url.js                             HTTP: Server returned no authentication headers.
|   http://192.168.1.172:80/themes/default/css/mobile.css             HTTP: Server returned no authentication headers.
|_  http://192.168.1.172:80/js/libs/jquery.min.js                     HTTP: Server returned no authentication headers.

Answer 1

它确实是一个wifi扩展器。我有一个来自亚马逊的 TP-Link TL-WA850RE，具有相同的 MAC 前缀。奇怪的是，这个前缀没有记录在任何 MAC 供应商数据库中。

值得庆幸的是，这篇（2 天前的）帖子已经被编入索引，因为这是我唯一可以通过谷歌搜索找到的东西:)

Nmap 输出：

Nmap scan report for 192.168.0.xxx
Host is up (0.0097s latency).
Not shown: 998 filtered ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     Cisco/3com IPSSHd 6.6.0 (protocol 2.0)
80/tcp open  http

带有 MAC 地址的 NMAP 输出：

Nmap scan report for 192.168.0.xxx
Host is up (0.070s latency).
MAC Address: B6:B0:24:07:**:** (Unknown)