Today I observed some strange behavior with an IP address on our network. Our main switch was reporting that it's MAC address kept changing, a couple times every minute. We pinged the IP repeatedly and cleared the ARP cache and with every clearing of the ARP we saw a new MAC entry.

We tracked it for some time and it seemed to be cycling through the MAC addresses of our wireless AP's. Every couple of seconds it would take the MAC of a different AP, and just keep going.

Has anyone seen behavior like this before? We tried everything we could think of try and track down the culprit but so far we have had no luck. How would one go about setting something like this up? And how can we track down it's origin?


  • I just want to make sure I understand the scenario. You have a seemingly random IP address on your network, which (I think) is a host of some kind. Your switch noticed rapidly changing MAC addresses for this IP, and when you did a little digging you noticed that these MAC addresses were also the ones in use by your wireless access points. The question you want answered is how to figure out what is answer ARP requests for an IP with MAC addresses from your WAPs. – theterribletrivium Sep 24 '14 at 2:54
  • You are correct about the scenario. Sorry for vague, I wasn't sure how much detail to really provide. We have a larger network which is broken into static and DHCP ranges and this IP happens to be in a range that is reserved for static assignment. The thing that is making it difficult is that this one single IP is changing the MAC's so quickly so to pin it down and perform testing is difficult because from second to second the MAC appears to be changing. – bourne Sep 24 '14 at 3:25
  • 1
    It may not be one machine changing MACs, but rather several machines trying to use the same IP. Are you sure the APs are properly configured so as not to use the same IP? – user49760 Nov 15 '14 at 17:01

The IP that is switching MAC address is simply spoofing its MAC address repetively. If you want to identify the machine spoofing it's mac adress, you could read up on this user suggestion : https://stackoverflow.com/questions/9546228/how-to-detect-the-original-mac-address-after-it-has-been-spoofed

  • Softy - this doesn't appear to answer the question – Rory Alsop Dec 24 '14 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.