When doing forensics, I saw the same MAC-address being used by two different IP-addresses in a splunk logfile:

139...  4681.791993  Apple_5a:77:9b  Apple_69:38:cc  ARP  64 is at 00:1f:f3:5a:77:9b
133...  4380.593992  Apple_5a:77:9b  Apple_69:38:cc  ARP  64 is at 00:1f:f3:5a:77:9b

What does that mean?

  • One of those IPs in a private address space, this is probably the same machine. How did you acquire your scan info?
    – iainpb
    Mar 9, 2017 at 11:33
  • from a log file, i am using splunk.
    – kaplangoz
    Mar 9, 2017 at 11:35
  • 1
    @iain Both are Private IPs. The second is APIPA Adress that gets selected if no DHCP or static IP is present
    – architekt
    Mar 9, 2017 at 11:57
  • @MartinFischer I have learned something new!
    – iainpb
    Mar 9, 2017 at 12:17

1 Answer 1


I would read your logs as follows:

  • is the IPv4 address the physical interface with MAC 00:1f:f3:5a:77:9b is using. I would tend to assume the IP was handed out via DHCP, but you would see a similar IP <-> MAC map if it was statically assigned (you simply would not be likely to see it from a DHCP server)

  • is a link-local address (https://en.wikipedia.org/wiki/Link-local_address), which in effect means it is an autoconfigured address the machine assigned to itself when all other IP assignment mechanisms failed (typically, this would happen when a node cannot get a DHCP assignment, potentially because the DHCP server has no free IPs to hand out, or because it is busy).

If the first two columns in your output are a reasonable proxy for timestamps, I would take all this to mean DHCP failed temporarily, before working again and providing the host with an address.

As a link-local address, traffic from 169.254/16 will not leave the broadcast domain, so in a forensic context, unless something happened within the broadcast domain, I would disregard it.

There is one specific use of this range that would possibly be worthwhile worrying about, which is a host announcing itself as within a cloud environment (see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)

  • Thanx for clear answer
    – kaplangoz
    Mar 9, 2017 at 13:03
  • @kaplangoz don´t forget to accept the answer (check marker below the rating of this answer)
    – architekt
    Mar 9, 2017 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.