0

I was wondering if the following MAC address is a valid one?

00:13:74:00:00:00

We have an automated network registration on the system whereby users can plug in their computers and register on the network with a given username/password. Anytime they want to register, the system would detect their MAC and make sure that no one else is using the same MAC under a different username. We have a user who is unable to register because her MAC address "conflicts" with someone else. I was wondering if that MAC is valid in the first place since the first 3 octets recognize vendor and last 3 should be different. I am not sure if all 0s would be fine because that looks too generic. Is is possible that the MAC address could've changed? If so, what are the possible causes of it? Any tips/suggestion and assistance would be appreciated. Thank you.

user1013264
  • 29
  • 2
  • Possibly causes: Users can manually set their MAC on most modern network cards. (Which is often a bad idea, but one easy to do). – Hennes Oct 10 '12 at 23:58
  • 00:13:74 is a valid vendor ID (Atheros) but I doubt that 00:00:00 is a valid device ID. – joeqwerty Oct 11 '12 at 00:03
  • 1
    Aye.MAC prefix prefix 00:13:74 is Atheros. (Adddress space 00:13:74:00:00:00 - 00:13:74:FF:FF:FF). But first MAC ever from them? Unlikely would be an understatement. :) – Hennes Oct 11 '12 at 00:05

3 Answers3

0

Can you possibly check the network card and settings of that user? Most probable posibilities are:

1) User changed his mac (knowingly or unknowingly - some download managers do that, to get a new IP via DHCP, etc.).

2) User has a weird/noname/knockoff network card, which doesn't have uniqe MAC addresses. Mostly happenes with cheap Chinese usb ethernet cards (happened to me too, ordered two for ~5usd each, both had the same MAC).

You can also verify if there really is another user with that MAC on the network - it is also possible that it's a parser error.

mulaz
  • 10,472
  • 1
  • 30
  • 37
0

The Wireshark OUI Lookup tool says...

00:13:74 Atheros Communications, Inc.

So, yes, it's probably a real wireless NIC.

As mulaz noted, there have been instances where vendors have released more than one card with the same MAC address. This causes all sorts of trouble if both cards end up on the same network.

Michael Hampton
  • 237,123
  • 42
  • 477
  • 940
0

According to a document from the IEEE, a MAC address of 00:00:00:00:00:00 could be assigned, which would imply that the MAC address you supplied is not necessarily incorrect. It does seeem exceptionally unlikely that someone would be assigned a MAC with the device portion of all zeroes, but it is not impossible.

As far as wether the MAC address is unique, I cannot say. It does sound like there was a bug in an Atheros driver update that may have caused the card to lose the device portion of the mac address. However, that report was in german on an unknown web forum, so I cannot say how reliable it may be. Regardless, she may not be maliciously changing her MAC address.

Mitch
  • 2,343
  • 14
  • 22