Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    MAC address 00:ab:00:00:00:00?

    DHCP and DNS
    5
    6
    6529
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Y
      yottabyte last edited by

      I noticed something screwy happening with my pfSense late at night and after some mucking around I found this in my DHCP leases:

      IP address      MAC address            Hostname    Start                              End                              Online    Lease Type
      192.168.2.6    00🆎00:00:00:00                          2012/04/03 03:07:33    1969/12/31 17:00:00    offline    active

      I tried looking this up in System Logs but the GUI only lets me see maximum 2000 entries, and it seems that the DHCP portion was wiped after I rebooted the system.  I have accounted for all the DHCP leases, except for this one, and as you can see it is quite unusual.

      Can this mean that someone cracked my WPA2 encryption and is using my WIFI with this spoofed MAC address?

      1 Reply Last reply Reply Quote 0
      • C
        cmb last edited by

        It could mean anything, no telling based on that description. Definitely a screwy MAC address but there are numerous possible reasons for that. Unlikely anyone cracked your WPA2 unless you're using a key like "password". That host show up in your ARP table?

        1 Reply Last reply Reply Quote 0
        • U
          urbangear last edited by

          i noticed it too

          IP address         MAC address   Hostname Start                         End                         Online Lease Type
          192.168.1.103 00🆎00:00:00:00         2012/04/24 16:27:13 1970/01/01 08:00:00 offline active

          1 Reply Last reply Reply Quote 0
          • jimp
            jimp Rebel Alliance Developer Netgate last edited by

            Might be interesting to see the contents of /var/dhcpd/var/db/dhcpd.leases and, if you can catch it, the DHCP logs from that request.

            1 Reply Last reply Reply Quote 0
            • T
              tzlwin last edited by

              I have the same problem here. Status -DHCP lease

              172.18.10.200 00🆎00:00:00:00 2012/07/27 09:28:26 1970/01/01 06:30:00

              It seems like never expired dhcp lease.

              1 Reply Last reply Reply Quote 0
              • T
                tzlwin last edited by

                I set this MAC to static IP and block this IP from accessing anything at Firewall Rules.
                I can't even manually delete this DHCP lease. What a strange?  :o

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post

                Products

                • Platform Overview
                • TNSR
                • pfSense
                • Appliances

                Services

                • Training
                • Professional Services

                Support

                • Subscription Plans
                • Contact Support
                • Product Lifecycle
                • Documentation

                News

                • Media Coverage
                • Press
                • Events

                Resources

                • Blog
                • FAQ
                • Find a Partner
                • Resource Library
                • Security Information

                Company

                • About Us
                • Careers
                • Partners
                • Contact Us
                • Legal
                Our Mission

                We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                Subscribe to our Newsletter

                Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                © 2021 Rubicon Communications, LLC | Privacy Policy