General discussion


DHCP and phantom MAC addresses?

By ljnelson ·
Problem: my win2000 box comes up on the wireless network. It shows up in the DHCP list as having two mac addresses and three (internal) IP addresses.

The computer in question is set to retrieve its IP via DHCP automatically. Basically, the behavior looks to the naked eye like this:
* Machine comes up, gets DHCP address (let's say assigned to MAC address 1. This is the MAC address reported by ipconfig /all.
* A couple of seconds pass and at the end of the boot sequence suddenly two more entries show up in the DHCP list (let's say and, *both assigned to a MAC address I've never seen before*.
* The computer in question is a Dell inspiron 4000 from around 2000. It has a Linksys wireless card in it that has been functioning fine for several years without demonstrating this behavior. What I mean by this is that as far as the computer is concerned there is one NIC with one MAC address on board (certainly not two).

I will happily divulge more details if anyone is interested and can point me to what's going on.

First off, is there any way for me to figure out what the **** this MAC address is? It's not to my wireless card, that's for sure.

Second, why on earth is my DHCP server (a Nexland router/firewall) happily assigning two IP addresses to the same MAC address?


This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

by ljnelson In reply to DHCP and phantom MAC addr ...

I should also mention that the odd MAC address in question begins with 52:41:53, which I can't find in any vendor database anywhere. Any ideas here?


Collapse -

by adembo In reply to DHCP and phantom MAC addr ...

I guess Im confused. You say there is a wireless card and a NIC on the laptop?? Then of course you will have two MAC addresses recorded by the laptop. If it has two network interfaces, then you will have two MAC addresses.

Wireless card = 1 MAC address
Built in NIC = 1 MAC address

Collapse -

by ljnelson In reply to DHCP and phantom MAC addr ...

Sorry, unclear above.

The only network connection mechanism at all that the computer has is a Linksys wireless card.

ipconfig /all reports one MAC address.

My router's logs/admin screen shows that the computer has been allocated a grand total of three IP addresses: one for the wireless card's MAC address, and two distinct IP addresses for another MAC address that I cannot figure out where it's coming from.

Preliminary research shows that the problem is related to Windows RAS, which apparently fires off DHCP requests for several IP addresses, but does so for its own "phantom" MAC address (that begins with the bytes "R", "A", "S", " ").


Collapse -

by CG IT In reply to DHCP and phantom MAC addr ...

humm RAS for VPN has a DHCP relay agent that if assigns remote clients a LAN address.

When you run the RAS configuration Wizard, RAS creates PPTP and L2TP mini-ports depending upon how many remote clients you want and the # of addresses in the DHCP relay agent pool. Therefore you will see DHCP assign addresses to those ports [which shows up as a computer] in DHCP reservations. [DHCP reserves those addresses for remote clients]

Collapse -

by ljnelson In reply to DHCP and phantom MAC addr ...

Thanks. The odd thing is that as far as I know I've never told RAS to do anything. I didn't even know what it was until last night.

Secondly, even if it behaves as you suggest, should there ever be a case where two IP addresses are assigned to the same MAC address, phony or not?


Collapse -

by hozcanhan In reply to DHCP and phantom MAC addr ...

CG IT is right . If you have configured your Win Box as a router through a wizard without understanding what you are doing ( if you started RRAS ) then you have more than one routing sources on your LAN . Check that no DHCP or Routing servers are running away anywhere . Another reason you are having this might be in wireless comm. the ethernet port has one mac/ip and the wireless port ( especially for APs or Bridges ) has another mac/ip . Also be careful may be your "double router" or phantom generator is reporting "also" the ASSOCIATED ports . Do these checks and post more info. we'll go from there.

Collapse -

by hozcanhan In reply to

nelson very clever work around ! enabling mac filter on the wireless . Yes it is a work around . The RRAS and other services are all reported in the list of services as manual or automatic . also the dependent services are also pointed . the dependent services of RAS goes down to RPC . Try turning these services off one by one , ie. turn it off and check . doesn't work turn it on . turn off another service and check . The problem should be in the microsoft database , with possible cures .

Collapse -

by ljnelson In reply to DHCP and phantom MAC addr ...

hozcanhan, CG IT: thanks for your help. hozcanhan, I've never done *anything* with RAS; I have no desire to--does it start automatically in some way? Is there a list of services I should disable from starting up on bootup?

Is there some other service or program that depends on or starts RAS without my knowing it? I have no need for RAS at all.

Thanks again you folks for your help so far.

I've temporarily resolved the *symptoms* of the problem in an ugly, hackish way: I've turned on MAC address filtering on my wireless access point (which is in front of the router/DHCP server box) so that the RAS MAC addresses are denied access. This restores normal behavior to the network, but obviously does not solve the cause of the problem.

Thanks again,

Related Discussions

Related Forums