Today I noticed many strange MAC addresses in our LAN. The addresses looked very similar – only few bits were changing. Sometime this happens, when Ethernet cable is damaged or due to network card malfunction. Here are some sample MAC addresses I observed:
- 000d3a-fa6109
- 000d3a-fa6207
- 000d3a-fa6209
- 000d3a-fa6107
- 000d3a-fa6203
- 000d3a-fa6103
- 000d3a-fa6212
- 000d3a-fa6112
- 000d3a-fa610f
- 000d3a-fa620f
It turns out, that this time these MAC addresses appeared because someone in our LAN clicked on See full map under Control Panel – Network and Sharing Center.
Microsoft documentation about Link Layer Topology Discovery (LLTD) Protocol states that:
This protocol defines a range of special MAC addresses that applications can use when they conduct network topology tests. This range is 0x000D3AD7F140 through 0x000D3AFFFFFF. These MAC addresses do not conflict with actual MAC addresses because the range is built from an assigned Organizationally Unique Identifier (OUI)…
Read more here:
http://www.microsoft.com/whdc/connect/rally/lltd-spec.mspx
http://download.microsoft.com/download/a/f/7/af7777e5-7dcd-4800-8a0a-b18336565f5b/LLTD-spec.doc
