Mysterious Missing ARP Entry

[Watters, John]

I need some help with a strange new problem - a persistent missing ARP entry.

We are a Cisco shop running WiSMs (6.0.199.4) with a mix of 1142s, 1131's and a 
few older 1242 APs.

This past Friday we got a report of 5 XP tablets that could not use the 
wireless network. These are 5 out of a group of 50 handheld tablets used in our 
hospital by the doctors for charting, etc. All of these are imaged and should 
be using the same image (and later reimaged to be sure). It turns out that that 
these five machines can use every SSID on campus except for one - their special 
one which uses WEP (no flames about WPA; we have tried to get them to move, but 
they are doctors and know more than anyone else). Further investigation has 
shown that these five machines never get an ARP entry built for their default 
gateway. They can talk to other machines on their subnet, but nothing outside. 
When a manual ARP entry is built for them, they are fine. This problem has 
persisted across reboots and reimaging of these five machines.

Today we have received reports of other machines on campus who have similar 
symptoms (we have yet to actually see one of them). They lose connectivity on 
one SSID but are OK on all others.

Has anyone else seen this? Can you give me a clue what to look for?


Along with the MAC address strangeness, which we are seeing, this problem has 
made for a very interesting few days.

Thanks for any help you can offer.


-jcw [cid:image002.jpg@01CB5E62.A701A560]


John WattersThe University of Alabama: OIT  205-348-3992


**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

<>

Re: [WIRELESS-LAN] Wireless N upgrade

[heath.barnhart]

 On 9/27/2010 3:16 PM, Entwistle, Bruce wrote:

We are currently looking at upgrading the wireless network in our residence 
halls to N.  I was looking to those who have recently conducted the same 
upgrade to please share their experiences.  What vendors were evaluated and why 
was the particular vendor chosen?  What equipment was in place prior to the 
upgrade?  What equipment is used for the wired network, link speed to the AP, 
and are there wired jacks in the rooms?  What challenges were encountered 
during the installation?  Looking back is there something you would do 
differently?



Thank you

Bruce Entwistle

Network Manager

University of Redlands





**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.




*What vendors were evaluated and why was the particular vendor chosen?*
Xirrus. The evaluation process had occurred prior to my arrival at Washburn. 
Xirrus provides high density wireless arrays (multiple radios per unit) and at 
the time they had upgrade plans in advance of 802.11n ratification. Once the 
standard was ratified it was a simple trade out of on unit for an N unit. 
Additionally each radio in the units can operate in either 2.4 GHz or 5 GHz.

*What equipment was in place prior to the upgrade?*
In most places Xirrus equipment was already in place and was simply replaced. 
We are now at the point were all of our pre-N equipment has been replaced or 
will be replaced soon. We are in the process of planning on upgrading the rest 
of our facilities which currently have older Cisco 1230 fat APs.

*What equipment is used for the wired network, link speed to the AP, and are 
there wired jacks in the rooms?*
It's recommended that infrastructure be Gigabit capable and have PoE regardless 
of vendor. We are using Cisco 3750s and Foundry/Brocade GS series.

*What challenges were encountered during the installation?*
The main challenge is figuring out best placement in relation to getting the 
right balance of overlap and coverage, and getting the channel planning right. 
With this being a residence hall, you also have to take into account what the 
students will be bringing with them that could mess with your deployment. 
Cordless phones, microwaves, and rouge devices will cause interference if they 
are allowed in the rooms. All you can do in that case is what your housing 
policy allows.

*Looking back is there something you would do differently?
*No.


--
Heath Barnhart, CCNA
Network Administrator
Information Systems and Services
Washburn University
Topeka, KS 66621


**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

Wireless N upgrade

[Entwistle, Bruce]

We are currently looking at upgrading the wireless network in our residence 
halls to N.  I was looking to those who have recently conducted the same 
upgrade to please share their experiences.  What vendors were evaluated and why 
was the particular vendor chosen?  What equipment was in place prior to the 
upgrade?  What equipment is used for the wired network, link speed to the AP, 
and are there wired jacks in the rooms?  What challenges were encountered 
during the installation?  Looking back is there something you would do 
differently?



Thank you

Bruce Entwistle

Network Manager

University of Redlands





**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[heath.barnhart]

 I've found one a possible droid as well.

Heath

On 9/27/2010 2:39 PM, Lee, Steven wrote:

The hostname android_977... appears to be a bug affecting Motorola Droid2's 
where many of them share the same IMEI 'International Mobile Equipment 
Identity', which is supposed to be unique:
http://groups.google.com/group/android-developers/browse_thread/thread/53898e508fab44f6/84e54feb28272384?lnk=raot

This does not appear to have any relation to the mac address issue in this 
thread but you gotta wonder as were are also seeing dhcp log entries with this 
ID associated to the 00:11:22:33:44:55 and also on a MAC that belongs to Intel.

steve



From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Johnson, Neil M
Sent: Monday, September 27, 2010 1:01 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Jaime,

I saw the exact same thing in our DHCP logs, including the hostname 
(android_977…) . Curious.

-Neil




--
Neil Johnson
Network Engineer
Information Technology Services
The University of Iowa
Work: 319 384-0938
Mobile: 319 540-2081
Fax: 319 355-2618
E-mail: neil-john...@uiowa.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Jamie Savage
Sent: Monday, September 27, 2010 9:18 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Just went back in our logs and we had a few hits with this MAC last week.  
However, the DHCP records indicate that this one has something to do with 
Android??

Sep 22 16:01:50 x.xx.yorku.ca dhcpd: 
event=dhcp_offer&loglevel=info&msg=DHCPOFFER on 192.168.100.211 to 
00:11:22:33:44:55 (android_9774d56d682e549c) via eth1 gw 192.168.100.2&

The android reference here is the computer name which could have been entered 
by the user but the subsequent alpha string would indicate it's a generated 
name.

thxJ

James Savage   York University
Senior Communications Tech.   108 Steacie Building
jsav...@yorku.ca4700 Keele Street
ph: 416-736-2100 ext. 22605Toronto, Ontario
fax: 416-736-5830M3J 1P3, CANADA



From:"Ingen Schenau, Jeroen van (ICTS)"
To:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Date:09/27/2010 10:02 AM
Subject:Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses
Sent by:The EDUCAUSE Wireless Issues Constituent Group 
Listserv




On Mon, 2010-09-27 at 09:39 -0400, Michael Dickson wrote:

Fascinating. We have one user on campus so far with this address:

00:11:22:33:44:55
Vendor (reported by Airwave): CIMSYS Inc

My € 0.02: we've seen three distinct users with that MAC, over the past
7 days. Same when looking over the last 31 days.


Regards,

Jeroen van Ingen
ICT Service Centre
University of Twente, P.O.Box 217, 7500 AE Enschede, The Netherlands

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/groups/.



--
Heath Barnhart, CCNA
Network Administrator
Information Systems and Services
Washburn University
Topeka, KS 66621

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

RE: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Lee, Steven]

The hostname android_977... appears to be a bug affecting Motorola Droid2's 
where many of them share the same IMEI 'International Mobile Equipment 
Identity', which is supposed to be unique:
http://groups.google.com/group/android-developers/browse_thread/thread/53898e508fab44f6/84e54feb28272384?lnk=raot

This does not appear to have any relation to the mac address issue in this 
thread but you gotta wonder as were are also seeing dhcp log entries with this 
ID associated to the 00:11:22:33:44:55 and also on a MAC that belongs to Intel.

steve



From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Johnson, Neil M
Sent: Monday, September 27, 2010 1:01 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Jaime,

I saw the exact same thing in our DHCP logs, including the hostname 
(android_977…) . Curious.

-Neil




--
Neil Johnson
Network Engineer
Information Technology Services
The University of Iowa
Work: 319 384-0938
Mobile: 319 540-2081
Fax: 319 355-2618
E-mail: neil-john...@uiowa.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Jamie Savage
Sent: Monday, September 27, 2010 9:18 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Just went back in our logs and we had a few hits with this MAC last week.  
However, the DHCP records indicate that this one has something to do with 
Android??

Sep 22 16:01:50 x.xx.yorku.ca dhcpd: 
event=dhcp_offer&loglevel=info&msg=DHCPOFFER on 192.168.100.211 to 
00:11:22:33:44:55 (android_9774d56d682e549c) via eth1 gw 192.168.100.2&

The android reference here is the computer name which could have been entered 
by the user but the subsequent alpha string would indicate it's a generated 
name.

thxJ

James Savage   York University
Senior Communications Tech.   108 Steacie Building
jsav...@yorku.ca4700 Keele Street
ph: 416-736-2100 ext. 22605Toronto, Ontario
fax: 416-736-5830M3J 1P3, CANADA



From:"Ingen Schenau, Jeroen van (ICTS)" 
To:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Date:09/27/2010 10:02 AM
Subject:Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses
Sent by:The EDUCAUSE Wireless Issues Constituent Group Listserv 





On Mon, 2010-09-27 at 09:39 -0400, Michael Dickson wrote:
> Fascinating. We have one user on campus so far with this address:
>
> 00:11:22:33:44:55
> Vendor (reported by Airwave): CIMSYS Inc

My € 0.02: we've seen three distinct users with that MAC, over the past
7 days. Same when looking over the last 31 days.


Regards,

Jeroen van Ingen
ICT Service Centre
University of Twente, P.O.Box 217, 7500 AE Enschede, The Netherlands

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/groups/.

Wireless position open at University of Colorado at Colorado Springs

[Greg Williams]

https://www.jobsatcu.com/applicants/jsp/shared/position/JobDetails_css.jsp?p
ostingId=236824 

 

Greg Williams

IT Security Principal
University of Colorado at Colorado Springs

Phone: 719-255-3211

Website:   http://www.uccs.edu/~itsecure 
  greg.willi...@uccs.edu

 


**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

Re: Macbooks with odd Airport MAC addresses

[Earl Barfield]

Date:Sat, 25 Sep 2010 23:42:02 -0500
From:"Hao, Justin C"
Subject: Re: Macbooks with odd Airport MAC addresses

That's really odd, apple supposedly doesn't own 00:11:22 as an oui, they do=
  own 00:11:24.. This is drawn from the IEEE.org oui lookup btw.

---
Justin Hao

On Sep 24, 2010, at 4:17 PM, "Cortes, Diana"  wrote:


Thought I'd share some interesting news... The student was able to recove=

r

the box where her Macbook Pro came in and indeed the Airport ID printed o=

n

the box is 00:11:22:33:44:55

Diana Cortes, CISSP, CWNA
University of Miami
IT - Telecommunications




Looking at the logs in my Airwave Management System, I've got a couple
of users here at Georgia Tech with that same mac address.  Must have
been some sort of foul-up in manufacturing.



--
Earl Barfield -- Academic & Research Tech / Information Technology
Georgia Institute of Technology, Atlanta Georgia, 30332
Internet: earl.barfi...@oit.gatech.edue...@gatech.edu

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

RE: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Johnson, Neil M]

Jaime,

I saw the exact same thing in our DHCP logs, including the hostname 
(android_977…) . Curious.

-Neil




--
Neil Johnson
Network Engineer
Information Technology Services
The University of Iowa
Work: 319 384-0938
Mobile: 319 540-2081
Fax: 319 355-2618
E-mail: neil-john...@uiowa.edu

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Jamie Savage
Sent: Monday, September 27, 2010 9:18 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Just went back in our logs and we had a few hits with this MAC last week.  
However, the DHCP records indicate that this one has something to do with 
Android??

Sep 22 16:01:50 x.xx.yorku.ca dhcpd: 
event=dhcp_offer&loglevel=info&msg=DHCPOFFER on 192.168.100.211 to 
00:11:22:33:44:55 (android_9774d56d682e549c) via eth1 gw 192.168.100.2&

The android reference here is the computer name which could have been entered 
by the user but the subsequent alpha string would indicate it's a generated 
name.

thxJ

James Savage   York University
Senior Communications Tech.   108 Steacie Building
jsav...@yorku.ca4700 Keele Street
ph: 416-736-2100 ext. 22605Toronto, Ontario
fax: 416-736-5830M3J 1P3, CANADA



From:"Ingen Schenau, Jeroen van (ICTS)" 
To:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Date:09/27/2010 10:02 AM
Subject:Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses
Sent by:The EDUCAUSE Wireless Issues Constituent Group Listserv 





On Mon, 2010-09-27 at 09:39 -0400, Michael Dickson wrote:
> Fascinating. We have one user on campus so far with this address:
>
> 00:11:22:33:44:55
> Vendor (reported by Airwave): CIMSYS Inc

My € 0.02: we've seen three distinct users with that MAC, over the past
7 days. Same when looking over the last 31 days.


Regards,

Jeroen van Ingen
ICT Service Centre
University of Twente, P.O.Box 217, 7500 AE Enschede, The Netherlands

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

** Participation and subscription information for this EDUCAUSE 
Constituent Group discussion list can be found at 
http://www.educause.edu/groups/.

Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Daniel Eklund]

I've seen two unique logins with that MAC in the past month. 

-- 
Daniel Eklund 
Director, Networking 
Wayne State University 
313-577-5558 








Justin, 



Thank you for pointing out that most management systems (AirWave, etc) use the 
MAC address as a unique identifier - it is supposed to be a unique hardware 
address. 



I’ve seen indication of that MAC on our Airwave Management Platform at Emory 
and can deduce we had 3-4 unique visitors, mostly on our guest network, but no 
successful authentications on our WPA-Enterprise network. The first sighting 
was on 07/23/2010, there was a sighting on 09/01/2010, and the last time I saw 
that MAC (possibly two separate users) was on 09/16/2010. I do have two 
different email addresses for the last two sightings, but will probably not 
pursue this further unless we have more sightings. This doesn’t seem like a big 
issue here, but it is troubling if a manufacturer is putting out product with 
duplicate unique hardware identifiers (MAC addresses). 




>>-> Stan Brooks - CWNA/CWSP 
Emory University 
University Technology Services 
404.727.0226 
AIM/Y!/Twitter: WLANstan 
MSN: wlans...@hotmail.com 
GoogleTalk: wlans...@gmail.com 



**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

RE: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Brooks, Stan]

Justin,

Thank you for pointing out that most management systems (AirWave, etc) use the 
MAC address as a unique identifier -  it is supposed to be a unique hardware 
address.

I've seen indication of that MAC on our Airwave Management Platform at Emory 
and can deduce we had 3-4 unique visitors, mostly on our guest network, but no 
successful authentications on our WPA-Enterprise network.  The first sighting 
was on 07/23/2010, there was a sighting on 09/01/2010, and the last time I saw 
that MAC (possibly two separate users) was on 09/16/2010.  I do have two 
different email addresses for the last two sightings, but will probably not 
pursue this further unless we have more sightings.  This doesn't seem like a 
big issue here, but it is troubling if a manufacturer is putting out product 
with duplicate unique hardware identifiers (MAC addresses).

 >>-> Stan Brooks - CWNA/CWSP
  Emory University
  University Technology Services
  404.727.0226
AIM/Y!/Twitter: WLANstan
   MSN: wlans...@hotmail.com
GoogleTalk: wlans...@gmail.com

From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Hao, Justin C
Sent: Monday, September 27, 2010 11:37 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

keep in mind that in airwave, the clients are uniquely identified by their mac 
address, so you'll need to check if multiple usernames show up associated to 
this single mac address, if this is the case, most likely it is multiple 
clients with either a manually configured mac address (due to WEP sniffing 
guides on the internet) or with possibly defective wireless NICs.

Airwave (and other monitoring systems) won't be able to show you the "real" 
manufacturer because they're only performing a standard oui lookup on the first 
3 octet.  what James (YorkU) did is the next logical step in trying to identify 
these clients by other metrics (hostname, useragent, etc) depending on how much 
time and interest you have in this.

We've seen at least 4 users all claiming to be 00:11:22:33:44:55 in the past 
week and we're internally discussing options on how to deal with this issue.

-
Justin Hao
CCNA
Network Engineer, ITS Networking
The University of Texas at Austin
j...@austin.utexas.edu
-

On Sep 27, 2010, at 9:10 AM, Holland, Ryan C. wrote:


I will second that. I, too, am seeing one client with this mac address, 
reported the same way via Airwave as CIMSYS Inc.

==
Ryan Holland
Network Engineer, Wireless
Office of the Chief Information Officer
The Ohio State University
614-292-9906   holland@osu.edu

On Sep 27, 2010, at 9:39 AM, Michael Dickson wrote:


Fascinating. We have one user on campus so far with this address:

00:11:22:33:44:55
Vendor (reported by Airwave): CIMSYS Inc

For Macbooks, the vendor is typically reported as Apple or Apple,Inc.

Mike


Michael Dickson 413.545.9639
Network AnalystUniv. of Massachusetts Amherst


On 9/26/2010 11:34 PM, Watters, John wrote:

I have 7 or 8  machines with this MAC address  on our campus. Is it possible 
that Apple did something not nice with the MAC addresses in the MacBooks? We 
will try to track some of them down, but it won't be easy even using the 
block-it-nd-they-will-come method.

-jcw


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[wireless-...@listserv.educause.edu] On Behalf Of Cortes, Diana 
[dcor...@miami.edu]
Sent: Friday, September 24, 2010 4:17 PM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Thought I'd share some interesting news... The student was able to recover
the box where her Macbook Pro came in and indeed the Airport ID printed on
the box is 00:11:22:33:44:55

Diana Cortes, CISSP, CWNA
University of Miami
IT - Telecommunications


-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Greg Williams
Sent: Monday, September 20, 2010 7:19 PM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Not sure if there is software out there for the mac to change this
automatically, if you just do an "ifconfig en1 ether xx:xx:xx:xx:xx:xx", the
mac address will change, but ONLY stay until you reboot the machine, then it
changes back.  You have to put that command into  a script under
/system/library/starupitems/ and then run
sudo chmod 700 script.sh
sudo defaults write com.apple.loginwindow LoginH

RE: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Peter P Morrissey]

Thanks. And the other sanity check would be that we haven't seen any evidence 
yet that this is anything other than someone configuring their NIC with this 
address. Perhaps we should be concerned about the security issues regarding 
this but until I see two different pictures of vendor MAC address stickers that 
have the same MAC address printed, count me as a skeptic.
Pete M.

-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Jeff Wolfe
Sent: Monday, September 27, 2010 11:32 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses


On 9/27/10 11:26 AM, John Duran wrote:
> We are also seeing a client with that MAC address (00:11:22:33:44:55) on
> our system.


Just a sanity check here, since most management systems seem to use MAC 
address as a primary key, it's likely you'll only 'see' one 
00:11:22:33:44:55 address associated at any given time, right?

DHCP logs or other auth logs may provide a more comprehensive list of 
how many devices are around, correct?


Has anyone contacted their respective Wireless hardware vendors for 
comments?


-JEff

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Hao, Justin C]

keep in mind that in airwave, the clients are uniquely identified by their mac 
address, so you'll need to check if multiple usernames show up associated to 
this single mac address, if this is the case, most likely it is multiple 
clients with either a manually configured mac address (due to WEP sniffing 
guides on the internet) or with possibly defective wireless NICs.

Airwave (and other monitoring systems) won't be able to show you the "real" 
manufacturer because they're only performing a standard oui lookup on the first 
3 octet.  what James (YorkU) did is the next logical step in trying to identify 
these clients by other metrics (hostname, useragent, etc) depending on how much 
time and interest you have in this.

We've seen at least 4 users all claiming to be 00:11:22:33:44:55 in the past 
week and we're internally discussing options on how to deal with this issue.

-
Justin Hao
CCNA
Network Engineer, ITS Networking
The University of Texas at Austin
j...@austin.utexas.edu
-

On Sep 27, 2010, at 9:10 AM, Holland, Ryan C. wrote:

I will second that. I, too, am seeing one client with this mac address, 
reported the same way via Airwave as CIMSYS Inc.

==
Ryan Holland
Network Engineer, Wireless
Office of the Chief Information Officer
The Ohio State University
614-292-9906   holland@osu.edu

On Sep 27, 2010, at 9:39 AM, Michael Dickson wrote:

Fascinating. We have one user on campus so far with this address:

00:11:22:33:44:55
Vendor (reported by Airwave): CIMSYS Inc

For Macbooks, the vendor is typically reported as Apple or Apple,Inc.

Mike


Michael Dickson 413.545.9639
Network Analyst Univ. of Massachusetts Amherst


On 9/26/2010 11:34 PM, Watters, John wrote:
I have 7 or 8  machines with this MAC address  on our campus. Is it possible 
that Apple did something not nice with the MAC addresses in the MacBooks? We 
will try to track some of them down, but it won't be easy even using the 
block-it-nd-they-will-come method.

-jcw


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[wireless-...@listserv.educause.edu] On Behalf Of Cortes, Diana 
[dcor...@miami.edu]
Sent: Friday, September 24, 2010 4:17 PM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Thought I'd share some interesting news... The student was able to recover
the box where her Macbook Pro came in and indeed the Airport ID printed on
the box is 00:11:22:33:44:55

Diana Cortes, CISSP, CWNA
University of Miami
IT - Telecommunications


-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Greg Williams
Sent: Monday, September 20, 2010 7:19 PM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Not sure if there is software out there for the mac to change this
automatically, if you just do an "ifconfig en1 ether xx:xx:xx:xx:xx:xx", the
mac address will change, but ONLY stay until you reboot the machine, then it
changes back.  You have to put that command into  a script under
/system/library/starupitems/ and then run
sudo chmod 700 script.sh
sudo defaults write com.apple.loginwindow LoginHook
/System/Library/StartupItems/script.sh

to get it to stick permanently.  So it seems to me like people are probably
doing this intentionally.

Greg Williams
IT Security Principal
University of Colorado at Colorado Springs
greg.willi...@uccs.edu


-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Hao, Justin C
Sent: Monday, September 20, 2010 4:34 PM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

it does show up occasionally, and as far as i can tell, this is because
users are following on-line tutorials for cracking WEP passwords (several of
them reference changing your mac interface to "00:11:22:33:44:55" manually
in the instructions to setup traffic sniffing.  If your users are using
these on a production network you may want to follow up as they may have
inadvertently changed their mac address and have no realized they need to
change it back.

or you could be mischievous and block that mac address completely and let
them come forwards to have their machine fixed.  I don't believe this is a
bug, but more user-inflicted.

-
Justin Hao
CCNA
Network Engineer, ITS Networking
The University of Texas at Austin
j...@austin.utexas.edu
-

On Sep 20, 2010, at 5:21 P

Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Jeff Wolfe]

On 9/27/10 11:26 AM, John Duran wrote:

We are also seeing a client with that MAC address (00:11:22:33:44:55) on
our system.



Just a sanity check here, since most management systems seem to use MAC 
address as a primary key, it's likely you'll only 'see' one 
00:11:22:33:44:55 address associated at any given time, right?


DHCP logs or other auth logs may provide a more comprehensive list of 
how many devices are around, correct?



Has anyone contacted their respective Wireless hardware vendors for 
comments?



-JEff

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[John Duran]

We are also seeing a client with that MAC address (00:11:22:33:44:55) on our 
system.
 
 
 
 
John V. Duran
Network Engineer 
University of New Mexico
Information Technologies
Ph: (505) 249-7890
Fax: (505) 277-8101


>>> "Holland, Ryan C."  9/27/2010 8:10 AM >>>
I will second that. I, too, am seeing one client with this mac address, 
reported the same way via Airwave as CIMSYS Inc.


==
Ryan Holland
Network Engineer, Wireless
Office of the Chief Information Officer

The Ohio State University
614-292-9906   holland@osu.edu

On Sep 27, 2010, at 9:39 AM, Michael Dickson wrote:



Fascinating. We have one user on campus so far with this address:

00:11:22:33:44:55
Vendor (reported by Airwave): CIMSYS Inc

For Macbooks, the vendor is typically reported as Apple or Apple,Inc.

Mike


Michael Dickson 413.545.9639
Network Analyst Univ. of Massachusetts Amherst


On 9/26/2010 11:34 PM, Watters, John wrote:


I have 7 or 8  machines with this MAC address  on our campus. Is it possible 
that Apple did something not nice with the MAC addresses in the MacBooks? We 
will try to track some of them down, but it won't be easy even using the 
block-it-nd-they-will-come method.





-jcw








From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[wireless-...@listserv.educause.edu] On Behalf Of Cortes, Diana 
[dcor...@miami.edu]


Sent: Friday, September 24, 2010 4:17 PM


To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU


Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses





Thought I'd share some interesting news... The student was able to recover


the box where her Macbook Pro came in and indeed the Airport ID printed on


the box is 00:11:22:33:44:55





Diana Cortes, CISSP, CWNA


University of Miami


IT - Telecommunications








-Original Message-


From: The EDUCAUSE Wireless Issues Constituent Group Listserv


[mailto:wireless-...@listserv.educause.edu] On Behalf Of Greg Williams


Sent: Monday, September 20, 2010 7:19 PM


To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU


Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses





Not sure if there is software out there for the mac to change this


automatically, if you just do an "ifconfig en1 ether xx:xx:xx:xx:xx:xx", the


mac address will change, but ONLY stay until you reboot the machine, then it


changes back.  You have to put that command into  a script under


/system/library/starupitems/ and then run


sudo chmod 700 script.sh


sudo defaults write com.apple.loginwindow LoginHook


/System/Library/StartupItems/script.sh





to get it to stick permanently.  So it seems to me like people are probably


doing this intentionally.





Greg Williams


IT Security Principal


University of Colorado at Colorado Springs


greg.willi...@uccs.edu








-Original Message-


From: The EDUCAUSE Wireless Issues Constituent Group Listserv


[mailto:wireless-...@listserv.educause.edu] On Behalf Of Hao, Justin C


Sent: Monday, September 20, 2010 4:34 PM


To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU


Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses





it does show up occasionally, and as far as i can tell, this is because


users are following on-line tutorials for cracking WEP passwords (several of


them reference changing your mac interface to "00:11:22:33:44:55" manually


in the instructions to setup traffic sniffing.  If your users are using


these on a production network you may want to follow up as they may have


inadvertently changed their mac address and have no realized they need to


change it back.





or you could be mischievous and block that mac address completely and let


them come forwards to have their machine fixed.  I don't believe this is a


bug, but more user-inflicted.





-


Justin Hao


CCNA


Network Engineer, ITS Networking


The University of Texas at Austin


j...@austin.utexas.edu


-





On Sep 20, 2010, at 5:21 PM, Cortes, Diana wrote:







Has anyone encountered any Macbooks with the following MAC addresses:


00:11:22:33:44:55? We believe this may be an Apple bug as we have found 2 on


our campus already with the exact same MAC address.









Thank you,









Diana Cortes, CISSP, CWNA




University of MIami




IT-Telecommunications









**




Participation and subscription information for this EDUCAUSE Constituent


Group discussion list can be found at http://www.educause.edu/groups/.





**


Participation and subscription information for this EDUCAUSE Constituent


Group discussion list can be found at http://www.educause.edu/groups/.





**


Participation and subscription information for this EDUCAUSE Constituent


Group discussion list can be found at http://www.educause.edu/groups/.





**


Participation and subscription information for t

Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Manoj Abeysekera]

I see a one too..Interesting!


Manoj



P. Manoj Abeysekera, CWNA, ACMP
Network Engineer
American University
4200 Wisconsin Ave, NW
Washington DC. 20016
202-885-2702




From:   "Holland, Ryan C." 
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Date:   09/27/2010 10:11 AM
Subject:Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses
Sent by:The EDUCAUSE Wireless Issues Constituent Group Listserv 




I will second that. I, too, am seeing one client with this mac address, 
reported the same way via Airwave as CIMSYS Inc.

==
Ryan Holland
Network Engineer, Wireless
Office of the Chief Information Officer
The Ohio State University
614-292-9906   holland@osu.edu

On Sep 27, 2010, at 9:39 AM, Michael Dickson wrote:

Fascinating. We have one user on campus so far with this address:

00:11:22:33:44:55
Vendor (reported by Airwave): CIMSYS Inc

For Macbooks, the vendor is typically reported as Apple or Apple,Inc.

Mike


Michael Dickson 413.545.9639
Network Analyst Univ. of Massachusetts Amherst


On 9/26/2010 11:34 PM, Watters, John wrote:
I have 7 or 8  machines with this MAC address  on our campus. Is it 
possible that Apple did something not nice with the MAC addresses in the 
MacBooks? We will try to track some of them down, but it won't be easy 
even using the block-it-nd-they-will-come method.

-jcw


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[wireless-...@listserv.educause.edu] On Behalf Of Cortes, Diana 
[dcor...@miami.edu]
Sent: Friday, September 24, 2010 4:17 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Thought I'd share some interesting news... The student was able to recover
the box where her Macbook Pro came in and indeed the Airport ID printed on
the box is 00:11:22:33:44:55

Diana Cortes, CISSP, CWNA
University of Miami
IT - Telecommunications


-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Greg Williams
Sent: Monday, September 20, 2010 7:19 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Not sure if there is software out there for the mac to change this
automatically, if you just do an "ifconfig en1 ether xx:xx:xx:xx:xx:xx", 
the
mac address will change, but ONLY stay until you reboot the machine, then 
it
changes back.  You have to put that command into  a script under
/system/library/starupitems/ and then run
sudo chmod 700 script.sh
sudo defaults write com.apple.loginwindow LoginHook
/System/Library/StartupItems/script.sh

to get it to stick permanently.  So it seems to me like people are 
probably
doing this intentionally.

Greg Williams
IT Security Principal
University of Colorado at Colorado Springs
greg.willi...@uccs.edu


-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Hao, Justin C
Sent: Monday, September 20, 2010 4:34 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

it does show up occasionally, and as far as i can tell, this is because
users are following on-line tutorials for cracking WEP passwords (several 
of
them reference changing your mac interface to "00:11:22:33:44:55" manually
in the instructions to setup traffic sniffing.  If your users are using
these on a production network you may want to follow up as they may have
inadvertently changed their mac address and have no realized they need to
change it back.

or you could be mischievous and block that mac address completely and let
them come forwards to have their machine fixed.  I don't believe this is a
bug, but more user-inflicted.

-
Justin Hao
CCNA
Network Engineer, ITS Networking
The University of Texas at Austin
j...@austin.utexas.edu
-

On Sep 20, 2010, at 5:21 PM, Cortes, Diana wrote:

Has anyone encountered any Macbooks with the following MAC addresses:
00:11:22:33:44:55? We believe this may be an Apple bug as we have found 2 
on
our campus already with the exact same MAC address.

Thank you,

Diana Cortes, CISSP, CWNA
University of MIami
IT-Telecommunications

**
Participation and subscription information for this EDUCAUSE Constituent
Group discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent
Group discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent
Group discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for

Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Jamie Savage]

Just went back in our logs and we had a few hits with this MAC last week. 
However, the DHCP records indicate that this one has something to do with 
Android??

Sep 22 16:01:50 x.xx.yorku.ca dhcpd: 
event=dhcp_offer&loglevel=info&msg=DHCPOFFER on 192.168.100.211 to 
00:11:22:33:44:55 (android_9774d56d682e549c) via eth1 gw 192.168.100.2&

The android reference here is the computer name which could have been 
entered by the user but the subsequent alpha string would indicate it's a 
generated name.

thxJ

James Savage   York University 
Senior Communications Tech.   108 Steacie Building
jsav...@yorku.ca4700 Keele Street
ph: 416-736-2100 ext. 22605Toronto, Ontario
fax: 416-736-5830M3J 1P3, CANADA 



From:   "Ingen Schenau, Jeroen van (ICTS)" 
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Date:   09/27/2010 10:02 AM
Subject:Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses
Sent by:The EDUCAUSE Wireless Issues Constituent Group Listserv 




On Mon, 2010-09-27 at 09:39 -0400, Michael Dickson wrote:
> Fascinating. We have one user on campus so far with this address:
> 
> 00:11:22:33:44:55
> Vendor (reported by Airwave): CIMSYS Inc

My ? 0.02: we've seen three distinct users with that MAC, over the past
7 days. Same when looking over the last 31 days.


Regards,

Jeroen van Ingen
ICT Service Centre
University of Twente, P.O.Box 217, 7500 AE Enschede, The Netherlands

**
Participation and subscription information for this EDUCAUSE Constituent 
Group discussion list can be found at http://www.educause.edu/groups/.


**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Holland, Ryan C.]

I will second that. I, too, am seeing one client with this mac address, 
reported the same way via Airwave as CIMSYS Inc.

==
Ryan Holland
Network Engineer, Wireless
Office of the Chief Information Officer
The Ohio State University
614-292-9906   holland@osu.edu

On Sep 27, 2010, at 9:39 AM, Michael Dickson wrote:

Fascinating. We have one user on campus so far with this address:

00:11:22:33:44:55
Vendor (reported by Airwave): CIMSYS Inc

For Macbooks, the vendor is typically reported as Apple or Apple,Inc.

Mike


Michael Dickson 413.545.9639
Network Analyst Univ. of Massachusetts Amherst


On 9/26/2010 11:34 PM, Watters, John wrote:
I have 7 or 8  machines with this MAC address  on our campus. Is it possible 
that Apple did something not nice with the MAC addresses in the MacBooks? We 
will try to track some of them down, but it won't be easy even using the 
block-it-nd-they-will-come method.

-jcw


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[wireless-...@listserv.educause.edu] On Behalf Of Cortes, Diana 
[dcor...@miami.edu]
Sent: Friday, September 24, 2010 4:17 PM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Thought I'd share some interesting news... The student was able to recover
the box where her Macbook Pro came in and indeed the Airport ID printed on
the box is 00:11:22:33:44:55

Diana Cortes, CISSP, CWNA
University of Miami
IT - Telecommunications


-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Greg Williams
Sent: Monday, September 20, 2010 7:19 PM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Not sure if there is software out there for the mac to change this
automatically, if you just do an "ifconfig en1 ether xx:xx:xx:xx:xx:xx", the
mac address will change, but ONLY stay until you reboot the machine, then it
changes back.  You have to put that command into  a script under
/system/library/starupitems/ and then run
sudo chmod 700 script.sh
sudo defaults write com.apple.loginwindow LoginHook
/System/Library/StartupItems/script.sh

to get it to stick permanently.  So it seems to me like people are probably
doing this intentionally.

Greg Williams
IT Security Principal
University of Colorado at Colorado Springs
greg.willi...@uccs.edu


-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Hao, Justin C
Sent: Monday, September 20, 2010 4:34 PM
To: 
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

it does show up occasionally, and as far as i can tell, this is because
users are following on-line tutorials for cracking WEP passwords (several of
them reference changing your mac interface to "00:11:22:33:44:55" manually
in the instructions to setup traffic sniffing.  If your users are using
these on a production network you may want to follow up as they may have
inadvertently changed their mac address and have no realized they need to
change it back.

or you could be mischievous and block that mac address completely and let
them come forwards to have their machine fixed.  I don't believe this is a
bug, but more user-inflicted.

-
Justin Hao
CCNA
Network Engineer, ITS Networking
The University of Texas at Austin
j...@austin.utexas.edu
-

On Sep 20, 2010, at 5:21 PM, Cortes, Diana wrote:

Has anyone encountered any Macbooks with the following MAC addresses:
00:11:22:33:44:55? We believe this may be an Apple bug as we have found 2 on
our campus already with the exact same MAC address.

Thank you,

Diana Cortes, CISSP, CWNA
University of MIami
IT-Telecommunications

**
Participation and subscription information for this EDUCAUSE Constituent
Group discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent
Group discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent
Group discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.
**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

*

Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Ingen Schenau, Jeroen van (ICTS)]

On Mon, 2010-09-27 at 09:39 -0400, Michael Dickson wrote:
> Fascinating. We have one user on campus so far with this address:
> 
> 00:11:22:33:44:55
> Vendor (reported by Airwave): CIMSYS Inc

My € 0.02: we've seen three distinct users with that MAC, over the past
7 days. Same when looking over the last 31 days.


Regards,

Jeroen van Ingen
ICT Service Centre
University of Twente, P.O.Box 217, 7500 AE Enschede, The Netherlands

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Michael Dickson]

Fascinating. We have one user on campus so far with this address:

00:11:22:33:44:55
Vendor (reported by Airwave): CIMSYS Inc

For Macbooks, the vendor is typically reported as Apple or Apple,Inc.

Mike


Michael Dickson 413.545.9639
Network Analyst Univ. of Massachusetts Amherst


On 9/26/2010 11:34 PM, Watters, John wrote:

I have 7 or 8  machines with this MAC address  on our campus. Is it possible 
that Apple did something not nice with the MAC addresses in the MacBooks? We 
will try to track some of them down, but it won't be easy even using the 
block-it-nd-they-will-come method.

-jcw


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[wireless-...@listserv.educause.edu] On Behalf Of Cortes, Diana 
[dcor...@miami.edu]
Sent: Friday, September 24, 2010 4:17 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Thought I'd share some interesting news... The student was able to recover
the box where her Macbook Pro came in and indeed the Airport ID printed on
the box is 00:11:22:33:44:55

Diana Cortes, CISSP, CWNA
University of Miami
IT - Telecommunications


-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Greg Williams
Sent: Monday, September 20, 2010 7:19 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Not sure if there is software out there for the mac to change this
automatically, if you just do an "ifconfig en1 ether xx:xx:xx:xx:xx:xx", the
mac address will change, but ONLY stay until you reboot the machine, then it
changes back.  You have to put that command into  a script under
/system/library/starupitems/ and then run
sudo chmod 700 script.sh
sudo defaults write com.apple.loginwindow LoginHook
/System/Library/StartupItems/script.sh

to get it to stick permanently.  So it seems to me like people are probably
doing this intentionally.

Greg Williams
IT Security Principal
University of Colorado at Colorado Springs
greg.willi...@uccs.edu


-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Hao, Justin C
Sent: Monday, September 20, 2010 4:34 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

it does show up occasionally, and as far as i can tell, this is because
users are following on-line tutorials for cracking WEP passwords (several of
them reference changing your mac interface to "00:11:22:33:44:55" manually
in the instructions to setup traffic sniffing.  If your users are using
these on a production network you may want to follow up as they may have
inadvertently changed their mac address and have no realized they need to
change it back.

or you could be mischievous and block that mac address completely and let
them come forwards to have their machine fixed.  I don't believe this is a
bug, but more user-inflicted.

-
Justin Hao
CCNA
Network Engineer, ITS Networking
The University of Texas at Austin
j...@austin.utexas.edu
-

On Sep 20, 2010, at 5:21 PM, Cortes, Diana wrote:


Has anyone encountered any Macbooks with the following MAC addresses:

00:11:22:33:44:55? We believe this may be an Apple bug as we have found 2 on
our campus already with the exact same MAC address.


Thank you,

Diana Cortes, CISSP, CWNA
University of MIami
IT-Telecommunications

**
Participation and subscription information for this EDUCAUSE Constituent

Group discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent
Group discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent
Group discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.
**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.


**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

RE: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Peter P Morrissey]

Let me get this straight. Are you guys saying that each address is exactly the 
same?
Pete M.

-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Matthew Gracie
Sent: Monday, September 27, 2010 9:09 AM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Watters, John wrote:
> I have 7 or 8  machines with this MAC address  on our campus. Is it
> possible that Apple did something not nice with the MAC addresses in
> the MacBooks? We will try to track some of them down, but it won't be
> easy even using the block-it-nd-they-will-come method.

My guess would be a manufacturing problem. When I was working for a
broadband provider, we sent out a boatload of NICs that had all been
shipped from the manufacturer with the MAC address FF:FF:FF:FF:FF:FF.

This was, unsurprisingly, problematic.

-- 
Matt Gracie (716) 888-8378
Information Security Administrator  grac...@canisius.edu
Canisius College ITSBuffalo, NY
http://www2.canisius.edu/~graciem/graciem_public_key.gpg

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Matthew Gracie]

Watters, John wrote:
> I have 7 or 8  machines with this MAC address  on our campus. Is it
> possible that Apple did something not nice with the MAC addresses in
> the MacBooks? We will try to track some of them down, but it won't be
> easy even using the block-it-nd-they-will-come method.

My guess would be a manufacturing problem. When I was working for a
broadband provider, we sent out a boatload of NICs that had all been
shipped from the manufacturer with the MAC address FF:FF:FF:FF:FF:FF.

This was, unsurprisingly, problematic.

-- 
Matt Gracie (716) 888-8378
Information Security Administrator  grac...@canisius.edu
Canisius College ITSBuffalo, NY
http://www2.canisius.edu/~graciem/graciem_public_key.gpg

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

RE: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

[Methven, Peter J]

We too are seeing that MAC address in our logging for our wireless service, 
although it doesn't look like there is an actual full user(s) log-in. It might 
be pure chance that we have a device which should be using that MAC address but 
I'm not convinced! So the issue may not just be limited to the USA.

Many Thanks
Peter

Mr Peter Methven, Network Specialist
Information Technology (IT)
Allen McTernan Building, Edinburgh Campus
Tel:  0131 451 3516
 
For IT support queries or requests, please email ith...@hw.ac.uk or phone ext 
4045, with full details of your query or request and your contact details.

http://www.hw.ac.uk/it


-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Watters, John
Sent: 27 September 2010 04:34
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

I have 7 or 8  machines with this MAC address  on our campus. Is it possible 
that Apple did something not nice with the MAC addresses in the MacBooks? We 
will try to track some of them down, but it won't be easy even using the 
block-it-nd-they-will-come method.

-jcw


From: The EDUCAUSE Wireless Issues Constituent Group Listserv 
[wireless-...@listserv.educause.edu] On Behalf Of Cortes, Diana 
[dcor...@miami.edu]
Sent: Friday, September 24, 2010 4:17 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Thought I'd share some interesting news... The student was able to recover
the box where her Macbook Pro came in and indeed the Airport ID printed on
the box is 00:11:22:33:44:55

Diana Cortes, CISSP, CWNA
University of Miami
IT - Telecommunications


-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Greg Williams
Sent: Monday, September 20, 2010 7:19 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

Not sure if there is software out there for the mac to change this
automatically, if you just do an "ifconfig en1 ether xx:xx:xx:xx:xx:xx", the
mac address will change, but ONLY stay until you reboot the machine, then it
changes back.  You have to put that command into  a script under
/system/library/starupitems/ and then run
sudo chmod 700 script.sh
sudo defaults write com.apple.loginwindow LoginHook
/System/Library/StartupItems/script.sh

to get it to stick permanently.  So it seems to me like people are probably
doing this intentionally.

Greg Williams
IT Security Principal
University of Colorado at Colorado Springs
greg.willi...@uccs.edu


-Original Message-
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:wireless-...@listserv.educause.edu] On Behalf Of Hao, Justin C
Sent: Monday, September 20, 2010 4:34 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses

it does show up occasionally, and as far as i can tell, this is because
users are following on-line tutorials for cracking WEP passwords (several of
them reference changing your mac interface to "00:11:22:33:44:55" manually
in the instructions to setup traffic sniffing.  If your users are using
these on a production network you may want to follow up as they may have
inadvertently changed their mac address and have no realized they need to
change it back.

or you could be mischievous and block that mac address completely and let
them come forwards to have their machine fixed.  I don't believe this is a
bug, but more user-inflicted.

-
Justin Hao
CCNA
Network Engineer, ITS Networking
The University of Texas at Austin
j...@austin.utexas.edu
-

On Sep 20, 2010, at 5:21 PM, Cortes, Diana wrote:

> Has anyone encountered any Macbooks with the following MAC addresses:
00:11:22:33:44:55? We believe this may be an Apple bug as we have found 2 on
our campus already with the exact same MAC address.
>
> Thank you,
>
> Diana Cortes, CISSP, CWNA
> University of MIami
> IT-Telecommunications
>
> **
> Participation and subscription information for this EDUCAUSE Constituent
Group discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent
Group discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent
Group discussion list can be found at http://www.educause.edu/groups/.

**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.
**
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.


-- 
Heriot-Watt University is a Scottish ch