Computer getting 4 new mac address daily

[Wayne Workman]

@jhalbert did you read the links that x23 posted below? I’m almost certain you have the exact same problem that the below links address.

[x23piracy]

@wayne-workman i was also feeling to ask if all has been read.

[jhalbert]

@wayne-workman I did. I am running windows 7 and not windows 10.

[Wayne Workman]

@jhalbert then you’re going to need to troubleshoot what’s going on by keeping a very close eye on the pending MACs list, and when a new MAC appears for this computer, just call the person and ask them what did they just do. Report back with what you find and we’ll try to help solve this.

[Avaryan]

WMI usually has details about any network devices. It logs the service name, mac address, adapter type, device name, etc…

What about making a script that logs any new network devices (that have MACs) and having it run periodically with a scheduled task? Might help you track down the cause.

[x23piracy]

Hi,

remember when i had my problem @tom-elliott had rumors about bluetooth devices that do things like that.
Is there a BT device in that system? Can you try to disable it and have a look if you still get macs?

Any special software that’s handling virtual network devices?

I hardly recommend you to read the whole thread here:
https://forums.fogproject.org/topic/10209/about-50-pending-macs-for-one-host-beware-of-windows-10-random-mac-feature-for-wlan?page=1

For me it was the wifi mac stuff but we talked about possible other causes, please confirm that you read all.

Regards X23

[Tom Elliott]

I’m a little speculative on the idea that this machine is not Windows 10. That doesn’t mean Windows 7 didn’t have a similar “feature” but this really sounds like the “Random MAC address” feature of Windows 10. You really need to find that machine.

[jhalbert]

@x23piracy yes on Bluetooth. I will check that out

[jhalbert]

@tom-elliott I check, that location has only 1 windows 10. It is in a different department. Company wide I only have 8 computers running windows 10. Only this site is having this as a problem. In the corp office I am using 10 and so is other people. We don’t see this problem. Some suggest that it could be a Bluetooth device. I think these computers have Bluetooth but I need to check. The person that is using this pc is not techy at all. He needs help with even the basic things. He calls us twice a week. He told me shutdown means to turn off the screen and turn it back on. For him to use Bluetooth would be far out their.

[jhalbert]

@wayne-workman Watching Fog is little hard to do. I have asked what he is doing but he tells me how he is doing his job. Is their a way to see what time these appear at? These guys write down everything they do per car they work on. I could use that to figure out what happen during the time the mac request appeared

[Wayne Workman]

@jhalbert said in Computer getting 4 new mac address daily:

Is their a way to see what time these appear at?

There are ways. I’ve written ugly monitors before, look at this for an example: https://github.com/FOGProject/fog-community-scripts/tree/master/MonitorFogStorageNodes

[jhalbert]

@wayne-workman I talk to the manager of this person today about what he does. I guess he using a very old tool and it needs the internet read the error codes. Everyone else is using laptops that we gave them. I guess all these macs I have is from the cars themselves. With this massive list of Mac address, does it hurt Fog to have a list of macs that is 50 plus long? To it is just lines in my database?

[Wayne Workman]

@jhalbert said in Computer getting 4 new mac address daily:

With this massive list of Mac address, does it hurt Fog to have a list of macs that is 50 plus long? To it is just lines in my database?

Well if you know it’s always going to be related to that one individual computer that employee is using, you could setup a daily cron job to delete other MACs associated with the host. This way, you don’t have to deal with it and the DB stays clean.

[jhalbert]

@wayne-workman sure that sounds like a plan. Do you have a script already for this?

[x23piracy]

@jhalbert said in Computer getting 4 new mac address daily:

I guess all these macs I have is from the cars themselves.

I would like to understand what is the cause here, the guy is using bluetooth device in different cars with his computers? And the macs you see are from the cars?

Regards X23

[Wayne Workman]

@jhalbert I can write it pretty fast, but not this morning.

The script will basically just delete all MACs associated with a specific host except for the real MAC - on a schedule. Like once a day via crontab.

[jhalbert]

@x23piracy I do IT support for dealerships. The dealer has a tool that connects to the car. Network to PC. PC to usb. USB to tool. Tool to Car. The tool comes from the car maker and it is not widely used by this dealership because it needs a massively long USB cable from the PC to the car. During the testing, it must be connected to the internet as the website manages the device and the car. In the past we have lost internet and destroy the EMC. EMC has to be replace and cost 1000’s each. That is why we moved to laptops. The laptop setup is Laptop to Car. No internet is required. We update the laptops with all the newest stuff. Sense this guy is using this old tool to connect to the cars, I am guessing fog is picking up the mac address from the car. Maybe the tool, I am not 100% sure which. I do know when ever he using this tool I get a new mac address. What great about this tool is, he can plug it into the car. The website auto list what doc to use to fix the cars problems. The laptops only show what is wrong in complete detail.

[Wayne Workman]

I did start work on the script this morning before work, It’ll be done tonight or tomorrow morning. I’ll post a link when it’s done.

[Wayne Workman]

@jhalbert Here’s the script:
https://github.com/FOGProject/fog-community-scripts/tree/master/delete-extra-macs-on-host
Set the variables at the top, and set it to run on a schedule in cron.

[jhalbert]

@wayne-workman Thank and it is working!