3

Today I observed some strange behavior with an IP address on our network. Our main switch was reporting that it's MAC address kept changing, a couple times every minute. We pinged the IP repeatedly and cleared the ARP cache and with every clearing of the ARP we saw a new MAC entry.

We tracked it for some time and it seemed to be cycling through the MAC addresses of our wireless AP's. Every couple of seconds it would take the MAC of a different AP, and just keep going.

Has anyone seen behavior like this before? We tried everything we could think of try and track down the culprit but so far we have had no luck. How would one go about setting something like this up? And how can we track down it's origin?

Cheers

Improve this question
3
  • I just want to make sure I understand the scenario. You have a seemingly random IP address on your network, which (I think) is a host of some kind. Your switch noticed rapidly changing MAC addresses for this IP, and when you did a little digging you noticed that these MAC addresses were also the ones in use by your wireless access points. The question you want answered is how to figure out what is answer ARP requests for an IP with MAC addresses from your WAPs.
    – theterribletrivium
    Commented Sep 24, 2014 at 2:54
  • You are correct about the scenario. Sorry for vague, I wasn't sure how much detail to really provide. We have a larger network which is broken into static and DHCP ranges and this IP happens to be in a range that is reserved for static assignment. The thing that is making it difficult is that this one single IP is changing the MAC's so quickly so to pin it down and perform testing is difficult because from second to second the MAC appears to be changing.
    – bourne
    Commented Sep 24, 2014 at 3:25
  • 1
    It may not be one machine changing MACs, but rather several machines trying to use the same IP. Are you sure the APs are properly configured so as not to use the same IP?
    – Zdenek
    Commented Nov 15, 2014 at 17:01

1 Answer 1

Reset to default
-1

The IP that is switching MAC address is simply spoofing its MAC address repetively. If you want to identify the machine spoofing it's mac adress, you could read up on this user suggestion : https://stackoverflow.com/questions/9546228/how-to-detect-the-original-mac-address-after-it-has-been-spoofed

Improve this answer
1
  • Softy - this doesn't appear to answer the question
    – Rory Alsop ♦
    Commented Dec 24, 2014 at 11:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .