Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    MAC address 00:ab:00:00:00:00

    Scheduled Pinned Locked Moved DHCP and DNS
    2 Posts 2 Posters 2.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      phil.davis
      last edited by

      I have this MAC address appearing at 1 site - see screenshot.
      Various people reported this in 2012 - http://forum.pfsense.org/index.php?topic=48100.0
      Being an ex-DEC VMS DECnet guy, it reminded me of DECnet and MOP protocol messages (which are not IP/TCP/UDP beasts). This has a list of various special MAC address formats used for various protocols - http://www.soa-admin.eu/fachowo/35-pojcia/62-multicast-mac-address.html
      This is interesting:

      AB-00-00-01-00-00	6001	DEC Maintenance Operation Protocol (MOP)
      

      which is close to the "00-AB-00" thing.
      But there is no way the site concerned has a DEC/VMS workstation or old router doing a MOP download, and in any case those devices would not ask DHCP for an IP address (they use DECnet…)
      I guess "00-AB-00" kicks off some other MAC addressing scheme for some other network protocol (Appletalk or ?) but I couldn't find it by Google.
      I am curious to work out what this is - if anyone else has clues?
      MAC-ab.png
      MAC-ab.png_thumb

      As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
      If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

      1 Reply Last reply Reply Quote 0
      • J
        jonallport
        last edited by

        My money is on a cheap NIC. I've seen some <$3 cards with completely fabricated MAC addresses, and often the whole batch will have the same address!

        Also it could be a legitimate NIC that's cr@pped-out the firmware.Ā  Have also seen this (when someone put the card in the PCI slot the wrong way round!!!) - Different MAC addresses in Windows driverĀ  than was showing in Wireshark - needless to say the card didn't work.

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.