+ Post New Thread
Results 1 to 14 of 14
Hardware Thread, Multiple MAC Address in Technical; Hi all Im not sure where to put this, but i think it might live here.... but here goes We ...
  1. #1

    Join Date
    May 2006
    Location
    Leicestershire
    Posts
    345
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Multiple MAC Address

    Hi all

    Im not sure where to put this, but i think it might live here.... but here goes

    We have some students with there own machines on the network, but what seems to be appearing is that we are getting multiple MAC address on a single switch port.

    We have disconnected these users from the main network, but when we go and have a look at the machine, all seems to be fine, no special piece of software, and AV is up to date and a full scan brings up nothing.

    So we are a bit stumped, and unsure if this is a hardware fault or an virus or trojan which is causing this...

    Any help would be great

    Thanks

    Niraj

  2. #2

    Join Date
    May 2006
    Location
    Leicestershire
    Posts
    345
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Re: Multiple MAC Address

    Having a look i think this should probably be placed in the networks section, but still am unsure...

    Admin feel free to move to approate location

    Thanks

  3. #3

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,812
    Thank Post
    110
    Thanked 585 Times in 506 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Multiple MAC Address

    Are you sure they aren't changing their MAC address (Linux boot CD, option in the driver config, etc)

  4. #4

    Join Date
    May 2006
    Location
    Leicestershire
    Posts
    345
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Re: Multiple MAC Address

    yea we are pretty sure... we had someone from the halls team go and check on one of the machines, and they said there was nothing unusal about the machine..... but i mean that could be a possibility thinking about it....

    What makes me doubt it though is that a couple of the machines have over 200 MAC address and there is one with over 1000 MAC address

  5. #5

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,812
    Thank Post
    110
    Thanked 585 Times in 506 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Multiple MAC Address

    I think it's too specific an error to be a physical cabling issue. Are the machines the same make/model? If they, are I'll go with driver problems. If they aren't, I'll go with virus/trojan/other evil software.

  6. #6


    tom_newton's Avatar
    Join Date
    Sep 2006
    Location
    Leeds
    Posts
    4,485
    Thank Post
    867
    Thanked 854 Times in 675 Posts
    Rep Power
    197

    Re: Multiple MAC Address

    Quite unlikely to be viral - not all NICs support changing the MAC, and I am not sure if there's even a reliable API call to do so.

    Would be interesting to know these extraneous MACs - if they are sequential, it would indicate that this *is* some kind of attack... i'm going for dodgy switch gear as a 1st port of call.

  7. #7

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    18,132
    Thank Post
    522
    Thanked 2,542 Times in 1,976 Posts
    Blog Entries
    24
    Rep Power
    876

    Re: Multiple MAC Address

    What make of network card do they have? I know SiS ones have some problems due to them being stupid with MAC addresses.

  8. #8


    Join Date
    Jan 2006
    Posts
    8,202
    Thank Post
    442
    Thanked 1,032 Times in 812 Posts
    Rep Power
    339

    Re: Multiple MAC Address

    I've seen problems like this - years ago with really cheap network cards bought from computer fairs. Loads of NICS had the same MAC, obviously factory rejects, fine for home use but caused no end of network problems when put together.

  9. #9
    DMcCoy's Avatar
    Join Date
    Oct 2005
    Location
    Isle of Wight
    Posts
    3,483
    Thank Post
    10
    Thanked 502 Times in 442 Posts
    Rep Power
    114

    Re: Multiple MAC Address

    They can also be virtual machines

  10. #10

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    18,132
    Thank Post
    522
    Thanked 2,542 Times in 1,976 Posts
    Blog Entries
    24
    Rep Power
    876

    Re: Multiple MAC Address

    I think 200 virtual machines would need a bit of a beefy server... Let alone 1000!

  11. #11
    DMcCoy's Avatar
    Join Date
    Oct 2005
    Location
    Isle of Wight
    Posts
    3,483
    Thank Post
    10
    Thanked 502 Times in 442 Posts
    Rep Power
    114

    Re: Multiple MAC Address

    I mean one or two odd addresses :P

  12. #12

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,592
    Thank Post
    109
    Thanked 770 Times in 598 Posts
    Rep Power
    183

    Re: Multiple MAC Address

    Until you said 200 to 1000 I was going to suggest that they may have added a hub/switch and started running multiple machines.

    They aren't creating network loops are they? The switch would then 'see' all the other MACS on the network if spanning tree isn't enabled.

  13. #13

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,812
    Thank Post
    110
    Thanked 585 Times in 506 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Multiple MAC Address

    I am not sure if there's even a reliable API call to do so.
    WinPcap will allow you to open raw sockets on Windows. Thus allowing you to construct IP frames by hand. Hilarity ensues.

  14. #14

    Join Date
    May 2006
    Location
    Leicestershire
    Posts
    345
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Re: Multiple MAC Address

    Thanks for the reply guys... i dont think it is a switch problem, we have all Cisco gear and with spanning tree turned on and have a dedicated networks team which im sure would be able to spot a loop back, but i will pass it on for it to be checked out....

    I work for a university and these are machines in student halls, so the make and model of the machines are generally all different...

    I am really stumped as to why this is taking place.... as for the faulty NIC, we gave one of the students a new NIC and it was doing the same thing, but with slightly more MAC address.... im inclined to think its some sort out nasty piece of software, but need to find out more info...

    I will update this thread once we find a solution, if we do that is..

    Cheers

    Niraj

SHARE:
+ Post New Thread

Similar Threads

  1. Global Address list in OWA
    By adamt82 in forum Educational Software
    Replies: 0
    Last Post: 26th July 2007, 01:28 PM
  2. New Email Address
    By Geoff in forum General Chat
    Replies: 0
    Last Post: 5th July 2007, 08:04 AM
  3. MSN, E-mail address
    By FN-GM in forum General Chat
    Replies: 72
    Last Post: 20th June 2007, 07:53 AM
  4. IP Address to Computer Name
    By Gambit in forum Windows
    Replies: 17
    Last Post: 23rd April 2007, 03:16 PM
  5. PHP and IP Address lookup
    By plexer in forum Web Development
    Replies: 0
    Last Post: 27th March 2007, 11:17 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •