MAC address 00:ab:00:00:00:00
-
I have this MAC address appearing at 1 site - see screenshot.
Various people reported this in 2012 - http://forum.pfsense.org/index.php?topic=48100.0
Being an ex-DEC VMS DECnet guy, it reminded me of DECnet and MOP protocol messages (which are not IP/TCP/UDP beasts). This has a list of various special MAC address formats used for various protocols - http://www.soa-admin.eu/fachowo/35-pojcia/62-multicast-mac-address.html
This is interesting:AB-00-00-01-00-00 6001 DEC Maintenance Operation Protocol (MOP)which is close to the "00-AB-00" thing.
But there is no way the site concerned has a DEC/VMS workstation or old router doing a MOP download, and in any case those devices would not ask DHCP for an IP address (they use DECnetā¦)
I guess "00-AB-00" kicks off some other MAC addressing scheme for some other network protocol (Appletalk or ?) but I couldn't find it by Google.
I am curious to work out what this is - if anyone else has clues?
-
My money is on a cheap NIC. I've seen some <$3 cards with completely fabricated MAC addresses, and often the whole batch will have the same address!
Also it could be a legitimate NIC that's cr@pped-out the firmware.Ā Have also seen this (when someone put the card in the PCI slot the wrong way round!!!) - Different MAC addresses in Windows driverĀ than was showing in Wireshark - needless to say the card didn't work.