MAC address 00:ab:00:00:00:00



  • I have this MAC address appearing at 1 site - see screenshot.
    Various people reported this in 2012 - http://forum.pfsense.org/index.php?topic=48100.0
    Being an ex-DEC VMS DECnet guy, it reminded me of DECnet and MOP protocol messages (which are not IP/TCP/UDP beasts). This has a list of various special MAC address formats used for various protocols - http://www.soa-admin.eu/fachowo/35-pojcia/62-multicast-mac-address.html
    This is interesting:

    AB-00-00-01-00-00	6001	DEC Maintenance Operation Protocol (MOP)
    

    which is close to the "00-AB-00" thing.
    But there is no way the site concerned has a DEC/VMS workstation or old router doing a MOP download, and in any case those devices would not ask DHCP for an IP address (they use DECnet…)
    I guess "00-AB-00" kicks off some other MAC addressing scheme for some other network protocol (Appletalk or ?) but I couldn't find it by Google.
    I am curious to work out what this is - if anyone else has clues?



  • My money is on a cheap NIC. I've seen some <$3 cards with completely fabricated MAC addresses, and often the whole batch will have the same address!

    Also it could be a legitimate NIC that's cr@pped-out the firmware.  Have also seen this (when someone put the card in the PCI slot the wrong way round!!!) - Different MAC addresses in Windows driver  than was showing in Wireshark - needless to say the card didn't work.


Log in to reply