0

I am in a situation where I have observed MAC addresses on a network that do not belong to any assigned OUI range, and this is causing some issues. I suspect the cause here is a heavy use of virtualization, but I am aware that VMWare ESX and other virtualization solutions use a assigned OUI range for virtual hosts, so why would that not be in use in this case? Is this something that others have seen? Would virtualization be the most likely explanation here? Is this becoming more common?

Fred Thomsen
  • 161
  • 1
  • 4
  • 1
    I can't speak for others, but I almost always assign KVM MACs that start `de:ad:be:ef`, so guilty as charged. – MadHatter Oct 01 '14 at 21:01
  • 1
    Administratively assigned IPs should always have bit 7 set, and unicast should have bit 8 unset. 'd' in 'deadbeef' violates both of these requirements. The first character should be '2', '6', 'a', or 'e'. Perhaps 'ab:ed:ca:fe'? More ideas http://www.datagenetics.com/blog/march32013/index.html – Chris S Oct 01 '14 at 21:19
  • I do realize this is a violation of those requirements. I am just trying to get a sense of how often this is done and why the OUI assigned to VMWare, Redhat, etc... for virtualization purposes aren't used. – Fred Thomsen Oct 01 '14 at 21:24
  • I don't think **anyone** but yourself can tell you what the most likely cause is.. Is this network only a server network? Is it a general access network? Right now the student network on our campus is operating without NAC (We are upgrading) and as such the little tikes have taken to all manor of MAC spoofing. – Daniel Widrick Oct 01 '14 at 21:50

0 Answers0