[ previous ] [ next ] [ threads ]
 
 From:  "Bryan K. Brayton" <bryan at sonicburst dot net>
 To:  <m0n0wall at lists dot m0n0 dot ch>
 Subject:  OT: Strange mac address on a network
 Date:  Thu, 10 Mar 2005 22:48:32 -0500
I'm seeing some strange mac addresses on a network [protected by a m0n0, the only shred of
on-topicness in this question :) ]
 
Specifically, I see the following addresses on a single edge port of a managed switch:
00:08:a1:01:00:01
21:34:00:01:00:01
45:00:00:01:00:01
63:e2:00:01:00:01
9f:25:00:01:00:01
 
I suspect someone has hooked up another switch to this port (or perhaps a wireless AP), but I've
never seen macs like these before and they aren't listed in any mac manufacturer cross reference I
can find.  They also aren't any ethernet multicast addresses either.  Now obviously they could be
spoofed, but they seem a little too nonrandom in the later bits to be spoofed.  I can't directly
look at what's plugged in to the port because it is in a private dorm room or I'd just take a look. 
I did shut the port off though :)
 
Any one seen this before or have any insight?
 
Thanks and apologies for the OT, but I figured this was as good a networking forum as anywhere else.
-Bryan