1

Several machines on my network have a MAC address that is beginning with the same three first pairs of numbers for example

MAC addresses

The MAC cannot be found in the IEEE, but when I reboot the machines they get new MAC addresses with the same ending but updated three first pairs of numbers. I can't figure out what is happening here. Is this an attack? I thought that MAC addresses stay fixed so long as no one has root access. All the machines are connected by Ethernet LAN.

AndiAna
  • 854
  • 6
  • 26

1 Answers1

1

I thought that MAC addresses stay fixed so long as no one has root access.

And I think that's generally true. However, someone (with root access) might have configured the system in a certain way, that keeps randomizing the MAC address. There's lots of ways to do this, so unfortunately you'll probably have to check every software that runs on those devices, and check its settings. Even Windows itself could be responsible for doing the MAC address changes:

When you're not connected to Wi-Fi, your PC sends a signal to look for Wi-Fi networks in the area to help you get connected. The signal contains the unique physical hardware (MAC) address for your device.

Some places, for example shopping malls, stores, or other public areas, might use this unique address to track your movement in that area. If your Wi-Fi hardware supports it, you can turn on random hardware addresses to make it harder for people to track you when your PC scans for networks and connects.

How to use random hardware addresses in Windows

Source: https://support.microsoft.com/en-us/windows/why-use-random-hardware-addresses-060ad2e9-526e-4f1c-9f3d-fe6a842640ed

finefoot
  • 9,914
  • 7
  • 59
  • 102
  • I see. but would it change the beginning of the MAC addresses of ubuntu machines where it doesn't have root access for? also the machines are of various types of NICs so not identical machines of the same manufacturer. – AndiAna Jun 23 '23 at 11:49
  • 1
    To change the MAC address you'll generally have to have access with root privileges. You can't just change the MAC address of one machine from another host. You'd still have to have some form of root access, e.g. via SSH. You'll have to check every machine that shows these symptoms for a local program or service that's running which would have the capability to change the MAC address and then check its settings. Such software exists for Ubuntu, too, yes. – finefoot Jun 26 '23 at 14:21