[plug] 801.11 gurus, anyone?

[Stephen Boak]

Once again, I hope you don't mind that I seem to have more questions
than answers on this forum.

I have just got wireless networking going on my firewall/server (I
know, they shouldn't be in the same box, but it is only a home
network...), and feeling very pleased with myself :)

The card is a Netgear WG311 PCI 802.11a/b/g, which after buying it
because it was based on a PrismII chip, turned out to be actually
based on Atheros. Never mind I thought, I can fix that - and I did.
It only took THREE DAYS days of work. But I learned a lot on the way!

Using the madwifi Atheros driver some things are not supported (yet),
such as ad-hoc networks, and lots I haven't figured out yet, but it
works and I can sit in my comfy chair out in the sun with my laptop
when the weather is nice :)

Now to the question - I run ntop to monitor my network, and it is
showing the wireless interface as multiple (a hundred or so!)
interfaces with diffrent MAC addresses. The mac addresses shown seem
to be the normal six octets, plus another two octets on the end. ie.
ifconfig -i ath0 reports HWaddr=00:09:5B:84:73:C8, in ntop it is
reported as 5B:84:73:C8:B0:AD, 5B:84:73:C8:10:ED, 5B:84:73:C8:00:B4
(top two octects dropped or not displayed?) etc. I can't tell from
the logs how often this happens, but guessing it changes about every
30 seconds to a miute by the time the link has been up. Or maybe more
often if it is reusing addrresses.

The IP address doesn't change, so the network is stable and
continuous. 

Weird.

Does 802.11 negotiate a new sub-mac address every few seconds, or 
packets?

Steve