[unisog] Odd MAC addresses on switch

John Kristoff jtk at northwestern.edu
Mon Jul 12 14:09:02 GMT 2004


On Mon, 12 Jul 2004 08:21:22 -0400
"Alan Moen" <amoen at vp.sdcl.wayne.edu> wrote:

> Today, one of our network security folks took a look at his port on the
> switch and came up with a very large number of MAC addresses associated with
> it - 271 addresses. The odd part is that all but the last address (which was
> the MAC on the machine we found when we went to investigate) had the form
> xx-xx-61-21-18-9f where the first two bytes changed but the last four
[...]
> Does anyone have an idea what he may have been doing there?

I seem to recall seeing something like this a few months back.  I don't
remember all the details and I can't find anything in a cursory search
of my archives, but I seem to remember it was as a result of an Apple-based
application.  It may have been some kind of bridging function that was
enabled either in the application or the OS.  You might check for some
weirdness along those lines.

John



More information about the unisog mailing list