Multiple MAC Address

[Nij.UK]

Hi all

 

Im not sure where to put this, but i think it might live here.... but here goes

 

We have some students with there own machines on the network, but what seems to be appearing is that we are getting multiple MAC address on a single switch port.

 

We have disconnected these users from the main network, but when we go and have a look at the machine, all seems to be fine, no special piece of software, and AV is up to date and a full scan brings up nothing.

 

So we are a bit stumped, and unsure if this is a hardware fault or an virus or trojan which is causing this...

 

Any help would be great

 

Thanks

 

Niraj

[Nij.UK]

Having a look i think this should probably be placed in the networks section, but still am unsure...

 

Admin feel free to move to approate location

 

Thanks

[Geoff]

Are you sure they aren't changing their MAC address (Linux boot CD, option in the driver config, etc)

[Nij.UK]

yea we are pretty sure... we had someone from the halls team go and check on one of the machines, and they said there was nothing unusal about the machine..... but i mean that could be a possibility thinking about it....

 

What makes me doubt it though is that a couple of the machines have over 200 MAC address and there is one with over 1000 MAC address

[Geoff]

I think it's too specific an error to be a physical cabling issue. Are the machines the same make/model? If they, are I'll go with driver problems. If they aren't, I'll go with virus/trojan/other evil software.

[tom_newton]

Quite unlikely to be viral - not all NICs support changing the MAC, and I am not sure if there's even a reliable API call to do so.

 

Would be interesting to know these extraneous MACs - if they are sequential, it would indicate that this *is* some kind of attack... i'm going for dodgy switch gear as a 1st port of call.

[localzuk]

What make of network card do they have? I know SiS ones have some problems due to them being stupid with MAC addresses.

[CyberNerd]

I've seen problems like this - years ago with really cheap network cards bought from computer fairs. Loads of NICS had the same MAC, obviously factory rejects, fine for home use but caused no end of network problems when put together.

[DMcCoy]

They can also be virtual machines

[localzuk]

I think 200 virtual machines would need a bit of a beefy server... Let alone 1000!

[DMcCoy]

I mean one or two odd addresses

[Ric_]

Until you said 200 to 1000 I was going to suggest that they may have added a hub/switch and started running multiple machines.

 

They aren't creating network loops are they? The switch would then 'see' all the other MACS on the network if spanning tree isn't enabled.

[Geoff]

I am not sure if there's even a reliable API call to do so.

 

WinPcap will allow you to open raw sockets on Windows. Thus allowing you to construct IP frames by hand. Hilarity ensues.

[Nij.UK]

Thanks for the reply guys... i dont think it is a switch problem, we have all Cisco gear and with spanning tree turned on and have a dedicated networks team which im sure would be able to spot a loop back, but i will pass it on for it to be checked out....

 

I work for a university and these are machines in student halls, so the make and model of the machines are generally all different...

 

I am really stumped as to why this is taking place.... as for the faulty NIC, we gave one of the students a new NIC and it was doing the same thing, but with slightly more MAC address.... im inclined to think its some sort out nasty piece of software, but need to find out more info...

 

I will update this thread once we find a solution, if we do that is..

 

Cheers

 

Niraj