Today I noticed many strange MAC addresses in our LAN. The addresses looked very similar – only few bits were changing. Sometime this happens, when Ethernet cable is damaged or due to network card malfunction. Here are some sample MAC addresses I observed:
- 000d3a-fa6109
- 000d3a-fa6207
- 000d3a-fa6209
- 000d3a-fa6107
- 000d3a-fa6203
- 000d3a-fa6103
- 000d3a-fa6212
- 000d3a-fa6112
- 000d3a-fa610f
- 000d3a-fa620f
It turns out, that this time these MAC addresses appeared because someone in our LAN clicked on See full map under Control Panel – Network and Sharing Center.
Microsoft documentation about Link Layer Topology Discovery (LLTD) Protocol states that:
This protocol defines a range of special MAC addresses that applications can use when they conduct network topology tests. This range is 0x000D3AD7F140 through 0x000D3AFFFFFF. These MAC addresses do not conflict with actual MAC addresses because the range is built from an assigned Organizationally Unique Identifier (OUI)…
Read more here:
http://www.microsoft.com/whdc/connect/rally/lltd-spec.mspx
http://download.microsoft.com/download/a/f/7/af7777e5-7dcd-4800-8a0a-b18336565f5b/LLTD-spec.doc
Thanks!
I have on Cisco switches port-security with one mac-address allowed to be registered in the MAC address table, and from time to time some ports where blocked as a second mac appear there. It seems that is this kind og mac which starts with 00:0d:3a…
I have now a point to start looking after what is generating this behavior (OS is WinXP not 7 like in your picture).