1

I can't find the device which is sending the ARP requests. The first three octets of the MAC address are 00ae13. But they are not assigned to a known manufacturer.

Does anybody have a clue what kind of device this could be?

  • Do you run virtual machines in your network? – Purefan Sep 10 '15 at 7:41
  • Yes, a couple of esx servers and a lot of machines. – mreg Sep 10 '15 at 7:41
  • 1
    Im trying to find evidence of this but my guess is that a hypervisor needs to fake MAC address and is possibly leaving out the manufacturer, so what you see is just the actual device identifier and not the first 3 octets. I'll post again if I find something to support my guess – Purefan Sep 10 '15 at 7:45
  • No, it's sending all digits, I just pasted here the first 3. There are 6 digit groups as usual, – mreg Sep 10 '15 at 7:51
  • 2
    What I understood from the article, this phrase "You can override the virtual network adapter MAC address configuration using the NetworkAddress key in the virtual machine registry" is basically what I suspected, that on interface 0050 the machine can send out packets with source 00ae.. . Or I'm wrong? – mreg Sep 10 '15 at 8:16
1

If you happen to use managed switch(es), you could log into your switch(es) and look into their forwarding table to see on what port of the switch is registered this mac address. You could then follow the trail up to its source.

The way to look at the forwarding table depends on the manufacturer of your switch(es). If your switch has a command line interface and you're familiar with terminal, try "show mac-address" (I know it to work on both my HP and Brocade switch). Else look at the Web GUI.

If your switch is not managed, or you don't have access to it, maybe you could find whose sending by capturing these arping packets on various places of your network: try sniffing the network using wireshark or tcpdump on suspicious VM, or on the physical network interface of your ESXi...

my 2 cents :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.