Networks

Ask something
Discussion Locked

Unknown MAC address

0 helpful
8 replies

by gigelul

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,
In a routine control I use "iptraf" on my Linux Internet Server. I have the surprise to see 3 unknown MAC address in my LAN. I can't figure out from where or how appear these. These MAC addresses don't generate traffic only some IN packets. I don't add new hardware in LAN and I don't change network cards.
Is there a possibility, using MAC address to obtain additional information?

8 replies

by stolson

If you go to

http://coffer.com/mac_find/

you can put in the MAC address and it will identify who the manufacturer is. This is a start. If you have Cisco switches, log in, get to the enable prompt and type

sh mac

This will show all MACs and what port they are associated with.

Let us know if this helps.

Steve Olson

by gigelul

I'm looking for your comments but I think that you don't subscribed to this question and you don't see my comments.
I reject your answer to catch your attention.
What is your opinion?

by gigelul

Hi Steve,
These are the unknown MAC addresses:
03:00:00:00:00:01
01:00:5E:00:01:16
01:00:5E:00:01:18
We use 3Com switches and in its database I don't find these addresses.
Also I try your link and no matches was returned.
What is your opinion? Can be the report of the "iptraf" bad, and maybe you can give an ideea why?
Thanks

by stolson

Since your MAC addresses were not in the public database, you could have equipment that is configured with a different address than the BIA (burned-in address).
You must track down, by process of elimination, the switch where the device or devices lie. Start at the switch the Linux box is plugged into. What port is the MAC showing up on? If you have cascaded switches, follow the ports back in the same manner until you find it.

by gigelul

I don't have any other information, only MAC address and some traffic: NON-IP packets only with a Win95 workstation. Can be this specific to Win95 OS? I use only TCP/IP protocol, the same like on the others WinNT workstations and no additional services.
I don't know if I can do something else! I think that it is the time to close this question.
Thanks for your time.

by gigelul

I use iptraf on Linux box and don't show me which port is used by these unknown MAC address only some traffic.
Today I found something: 03:00:00:00:00:01 address, transfer packets only with Win95 workstation (I have 3 computers with Win95, the restof the computers are with WinNT)

This discussion is closed to new replies.