-
-
Notifications
You must be signed in to change notification settings - Fork 438
Description
Hi there,
Sorry for posting here, even it's more of a LibPax topic. But there's a much higher chance of getting an answer here. :)
We used a prototype of the PaxCounter with an enhanced scan window of six hours for testing purposes.
I was surprised by the counting values (very high), so I spent some time investigating in the LibPax.
I found the following line in the code:
https://github.com/dbinfrago/libpax/blob/3cdc0371c375676a97967547f4065607d4c53fd1/lib/libpax/libpax.cpp#L77
Definition of ("universal" and "local" mac addresses)
"The second least significant bit of the first byte determines whether a MAC address is universally or locally administered."
So...
0 (even) | Universally administered (assigned by vendor)
1 (odd) | Locally administered (likely randomized)
// if it is NOT a locally administered ("random") mac, we don't count it
if (!(paddr[0] & 0b10)) return false;
Besides the fact that also the comment is incorrect, this if statement filters all real MAC addresses and returns false. The 'not' operator is the problem.
I would suggest:
// if it is a locally administered ("random") mac, we don't count it
if (paddr[0] & 0b10) return false;
What do you think?