My team is inspecting some MAC Spoofing events that are triggering in our corporate environment. After talking it over with the team, this is the information that we have that is relevant....
- The events are being triggered by our client-side software firewalls.
- There are occurrences across the network, seeing that MAC spoofing is limited to layer 2, this leads us away from the idea of intentional malicious activity seeing that we do not have a flat network.
- We know of issues that our firewall has had in past versions when it comes to picking up MAC spoofing, but there's nothing to indicate that issue with our current implementation.
- We are currently trying to figure out the OS types for the source & destination systems.
- There is no documented security exception/reason why any of our machines would be spoofing their MAC addresses
- These events started occurring recently and have continued to occur (over the last 3-4 days).
- This is a given by my other points, but we have not successfully be able to recreate the event on machines that we are testing.
Any help figuring out the source of this issue would be appreciated. I'll update if we find any additional helpful information or if we resolve the issue (I've just been brought onto this issue, so I don't have a complete understanding of what we know yet).
P.S. I can't, in sound mind, give any more information as to what products we use for our security systems.