That is the default MAC spoof address for the Cain and Able product. http://www.oxid.it/ca_um/topics/apr_related_faqs.htm You may be seeing intentional spoofs. My apologies if someone already mentioned this.
http://www.oxid.it/cain.html Thanks! -----Original Message----- From: The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:[email protected]] On Behalf Of McNealy, Justin S Sent: Wednesday, October 20, 2010 8:21 AM To: [email protected] Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses Throwing in our 2 cent. We have seen multiple devices using that mac address with in the past year. Mainly androids but one blackberry and at least one that was wired CAM entries for this interface: Unicast Entries vlan mac address type protocols port -------+---------------+--------+---------------------+-------------------- 56 0011.2233.4455 dynamic ip FastEthernet3/9 Jay McNealy Network Engineer II Medical University Of South Carolina -----Original Message----- From: The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:[email protected]] On Behalf Of heath.barnhart Sent: Monday, September 27, 2010 3:54 PM To: [email protected] Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses I've found one a possible droid as well. Heath On 9/27/2010 2:39 PM, Lee, Steven wrote: > The hostname android_977... appears to be a bug affecting Motorola Droid2's > where many of them share the same IMEI 'International Mobile Equipment > Identity', which is supposed to be unique: > http://groups.google.com/group/android-developers/browse_thread/thread/53898e508fab44f6/84e54feb28272384?lnk=raot > > This does not appear to have any relation to the mac address issue in this > thread but you gotta wonder as were are also seeing dhcp log entries with > this ID associated to the 00:11:22:33:44:55 and also on a MAC that belongs to > Intel. > > steve > > > ________________________________ > From: The EDUCAUSE Wireless Issues Constituent Group Listserv > [mailto:[email protected]] On Behalf Of Johnson, Neil M > Sent: Monday, September 27, 2010 1:01 PM > To: [email protected] > Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses > > Jaime, > > I saw the exact same thing in our DHCP logs, including the hostname > (android_977…) . Curious. > > -Neil > > > > > -- > Neil Johnson > Network Engineer > Information Technology Services > The University of Iowa > Work: 319 384-0938 > Mobile: 319 540-2081 > Fax: 319 355-2618 > E-mail: [email protected] > > From: The EDUCAUSE Wireless Issues Constituent Group Listserv > [mailto:[email protected]] On Behalf Of Jamie Savage > Sent: Monday, September 27, 2010 9:18 AM > To: [email protected] > Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses > > Just went back in our logs and we had a few hits with this MAC last week. > However, the DHCP records indicate that this one has something to do with > Android?? > > Sep 22 16:01:50 xxxxx.xx.yorku.ca dhcpd: > event=dhcp_offer&loglevel=info&msg=DHCPOFFER on 192.168.100.211 to > 00:11:22:33:44:55 (android_9774d56d682e549c) via eth1 gw 192.168.100.2& > > The android reference here is the computer name which could have been entered > by the user but the subsequent alpha string would indicate it's a generated > name. > > ........thx............J > > James Savage York University > Senior Communications Tech. 108 Steacie Building > [email protected] 4700 Keele Street > ph: 416-736-2100 ext. 22605 Toronto, Ontario > fax: 416-736-5830 M3J 1P3, CANADA > > > > From: "Ingen Schenau, Jeroen van (ICTS)"<[email protected]> > To: [email protected] > Date: 09/27/2010 10:02 AM > Subject: Re: [WIRELESS-LAN] Macbooks with odd Airport MAC addresses > Sent by: The EDUCAUSE Wireless Issues Constituent Group > Listserv<[email protected]> > ________________________________ > > > > On Mon, 2010-09-27 at 09:39 -0400, Michael Dickson wrote: >> Fascinating. We have one user on campus so far with this address: >> >> 00:11:22:33:44:55 >> Vendor (reported by Airwave): CIMSYS Inc > My € 0.02: we've seen three distinct users with that MAC, over the past > 7 days. Same when looking over the last 31 days. > > > Regards, > > Jeroen van Ingen > ICT Service Centre > University of Twente, P.O.Box 217, 7500 AE Enschede, The Netherlands > > ********** > Participation and subscription information for this EDUCAUSE Constituent > Group discussion list can be found at http://www.educause.edu/groups/. > > ********** Participation and subscription information for this EDUCAUSE > Constituent Group discussion list can be found at > http://www.educause.edu/groups/. -- Heath Barnhart, CCNA Network Administrator Information Systems and Services Washburn University Topeka, KS 66621 ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/groups/.
