Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I was wondering if the following MAC address is a valid one?

00:13:74:00:00:00

We have an automated network registration on the system whereby users can plug in their computers and register on the network with a given username/password. Anytime they want to register, the system would detect their MAC and make sure that no one else is using the same MAC under a different username. We have a user who is unable to register because her MAC address "conflicts" with someone else. I was wondering if that MAC is valid in the first place since the first 3 octets recognize vendor and last 3 should be different. I am not sure if all 0s would be fine because that looks too generic. Is is possible that the MAC address could've changed? If so, what are the possible causes of it? Any tips/suggestion and assistance would be appreciated. Thank you.

share|improve this question
    
Possibly causes: Users can manually set their MAC on most modern network cards. (Which is often a bad idea, but one easy to do). –  Hennes Oct 10 '12 at 23:58
    
00:13:74 is a valid vendor ID (Atheros) but I doubt that 00:00:00 is a valid device ID. –  joeqwerty Oct 11 '12 at 0:03
1  
Aye.MAC prefix prefix 00:13:74 is Atheros. (Adddress space 00:13:74:00:00:00 - 00:13:74:FF:FF:FF). But first MAC ever from them? Unlikely would be an understatement. :) –  Hennes Oct 11 '12 at 0:05

3 Answers 3

Can you possibly check the network card and settings of that user? Most probable posibilities are:

1) User changed his mac (knowingly or unknowingly - some download managers do that, to get a new IP via DHCP, etc.).

2) User has a weird/noname/knockoff network card, which doesn't have uniqe MAC addresses. Mostly happenes with cheap Chinese usb ethernet cards (happened to me too, ordered two for ~5usd each, both had the same MAC).

You can also verify if there really is another user with that MAC on the network - it is also possible that it's a parser error.

share|improve this answer

The Wireshark OUI Lookup tool says...

00:13:74 Atheros Communications, Inc.

So, yes, it's probably a real wireless NIC.

As mulaz noted, there have been instances where vendors have released more than one card with the same MAC address. This causes all sorts of trouble if both cards end up on the same network.

share|improve this answer

According to a document from the IEEE, a MAC address of 00:00:00:00:00:00 could be assigned, which would imply that the MAC address you supplied is not necessarily incorrect. It does seeem exceptionally unlikely that someone would be assigned a MAC with the device portion of all zeroes, but it is not impossible.

As far as wether the MAC address is unique, I cannot say. It does sound like there was a bug in an Atheros driver update that may have caused the card to lose the device portion of the mac address. However, that report was in german on an unknown web forum, so I cannot say how reliable it may be. Regardless, she may not be maliciously changing her MAC address.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.