[unisog] Odd MAC addresses on switch

Alan Moen amoen at vp.sdcl.wayne.edu
Mon Jul 12 12:21:22 GMT 2004

On our residential network we've got a student who stands out because of his
repeated viral infections and stubborn denials of having done nothing wrong.

Today, one of our network security folks took a look at his port on the
switch and came up with a very large number of MAC addresses associated with
it - 271 addresses. The odd part is that all but the last address (which was
the MAC on the machine we found when we went to investigate) had the form
xx-xx-61-21-18-9f where the first two bytes changed but the last four
remained the same. No one here has seen anything like this, so we're not
sure if this guy was running an application to change his MAC or had some
other device connected earlier in the day - he wasn't home when we went

Does anyone have an idea what he may have been doing there?

Thanks for your time,

Alan K. Moen
Lead Business Systems Analyst
Business and Auxiliary Operations
Wayne State University

More information about the unisog mailing list