• Recent
  • Unsolved
  • Tags
  • Popular
  • Users
  • Groups
  • Search
  • Register
  • Login
  • Recent
  • Unsolved
  • Tags
  • Popular
  • Users
  • Groups
  • Search
  • Register
  • Login

About 50 Pending macs for one host? Beware of Windows 10 random MAC feature for WLAN!

Scheduled Pinned Locked Moved Solved
FOG Problems
5
53
17.9k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • X
    x23piracy @Tom Elliott
    last edited by x23piracy Jun 8, 2017, 7:49 AM Jun 8, 2017, 1:48 PM

    @Tom-Elliott ok i’ve shortened it to the first 3 octetts like you recommended. I’ve read the hint for the setting but i thougth filtering until mac change would be better, but i did what you told me 😉

    ║▌║█║▌│║▌║▌█

    1 Reply Last reply Reply Quote 0
    • X
      x23piracy
      last edited by x23piracy Jun 8, 2017, 7:59 AM Jun 8, 2017, 1:50 PM

      @Tom-Elliott @Wayne-Workman the first pending mac is back
      alt text

      argh oh nooo 😞

      I cannot find this MAC Adress (d2:b1:a5:d6:12:7c) on any MAC Vendor list, this sounds to me like a virtual adapter too.
      Would it be a good idea to also filter d2:b1:a5 without any research?

      ║▌║█║▌│║▌║▌█

      T 1 Reply Last reply Jun 8, 2017, 2:06 PM Reply Quote 0
      • T
        Tom Elliott @x23piracy
        last edited by Jun 8, 2017, 2:06 PM

        @x23piracy we need to found it why it thinks it’s it4314 first.

        Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

        Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

        Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

        X 1 Reply Last reply Jun 8, 2017, 2:07 PM Reply Quote 0
        • X
          x23piracy @Tom Elliott
          last edited by x23piracy Jun 8, 2017, 8:08 AM Jun 8, 2017, 2:07 PM

          @Tom-Elliott sorry i really would do this but i am a little bit lost with it 😞 what should i do next? any help is appreciated.

          ║▌║█║▌│║▌║▌█

          T 1 Reply Last reply Jun 8, 2017, 2:09 PM Reply Quote 0
          • T
            Tom Elliott @x23piracy
            last edited by Jun 8, 2017, 2:09 PM

            @x23piracy You can look in the access log and hopefully see the host that applied this mac address.

            Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

            Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

            Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

            X 1 Reply Last reply Jun 8, 2017, 2:20 PM Reply Quote 0
            • X
              x23piracy @Tom Elliott
              last edited by Jun 8, 2017, 2:20 PM

              @Tom-Elliott

              172.19.101.150 - - [08/Jun/2017:13:18:25 +0200] "GET /fog/management/index.php?sub=requestClientInfo&mac=40:B0:34:11:A6:D2%7CF4:8C:50:49:D1:AE%7CF4:8C:50:49:D1:B1%7CD2:B1:A5:D6:12:7C&newService&json HTTP/1.1" 200 1705 "-" "-"
              172.19.101.150 - - [08/Jun/2017:13:18:27 +0200] "GET /fog/service/usertracking.report.php?action=login&user=it4314%5Ccca&mac=40:B0:34:11:A6:D2%7CF4:8C:50:49:D1:AE%7CF4:8C:50:49:D1:B1%7CD2:B1:A5:D6:12:7C&newService&json HTTP/1.1" 200 583 "-" "-"
              172.19.101.150 - - [08/Jun/2017:13:20:37 +0200] "GET /fog/management/index.php?sub=requestClientInfo&mac=40:B0:34:11:A6:D2%7CF4:8C:50:49:D1:AE%7CF4:8C:50:49:D1:B1%7CD2:B1:A5:D6:12:7C&newService&json HTTP/1.1" 200 1705 "-" "-"
              172.19.101.150 - - [08/Jun/2017:13:23:08 +0200] "GET /fog/management/index.php?sub=requestClientInfo&mac=40:B0:34:11:A6:D2%7CF4:8C:50:49:D1:AE%7CF4:8C:50:49:D1:B1%7CD2:B1:A5:D6:12:7C&newService&json HTTP/1.1" 200 1705 "-" "-"
              172.19.101.150 - - [08/Jun/2017:13:24:19 +0200] "GET /fog/management/index.php?sub=requestClientInfo&mac=40:B0:34:11:A6:D2%7CF4:8C:50:49:D1:AE%7CF4:8C:50:49:D1:B1%7CD2:B1:A5:D6:12:7C&newService&json HTTP/1.1" 200 1705 "-" "-"
              172.19.101.150 - - [08/Jun/2017:13:26:44 +0200] "GET /fog/management/index.php?sub=requestClientInfo&mac=40:B0:34:11:A6:D2%7CF4:8C:50:49:D1:AE%7CF4:8C:50:49:D1:B1%7CD2:B1:A5:D6:12:7C&newService&json HTTP/1.1" 200 1705 "-" "-"
              

              172.19.101.150 belongs to IT4314 🙂 hrhr

              ║▌║█║▌│║▌║▌█

              1 Reply Last reply Reply Quote 0
              • T
                Tom Elliott
                last edited by Jun 8, 2017, 2:27 PM

                So what we know, so far, is it appears IT4314 IS registering these pending macs?

                Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                1 Reply Last reply Reply Quote 0
                • X
                  x23piracy @Tom Elliott
                  last edited by Jun 8, 2017, 2:48 PM

                  @Tom-Elliott after chatting with tom we decided to remove the fog client from it4314, i also removed all the pending macs again. Now lets wait what happens.

                  ║▌║█║▌│║▌║▌█

                  1 Reply Last reply Reply Quote 0
                  • X
                    x23piracy
                    last edited by Jun 8, 2017, 3:00 PM

                    @Tom-Elliott Information about IT4314

                    ipconfig /all

                    
                    Windows-IP-Konfiguration
                    
                       Hostname  . . . . . . . . . . . . : it4314
                       Prim„res DNS-Suffix . . . . . . . : haan.local
                       Knotentyp . . . . . . . . . . . . : Hybrid
                       IP-Routing aktiviert  . . . . . . : Nein
                       WINS-Proxy aktiviert  . . . . . . : Nein
                       DNS-Suffixsuchliste . . . . . . . : haan.local
                                                           carbolite.local
                    
                    Ethernet-Adapter Ethernet:
                    
                       Verbindungsspezifisches DNS-Suffix: haan.local
                       Beschreibung. . . . . . . . . . . : Intel(R) Ethernet Connection I219-LM
                       Physische Adresse . . . . . . . . : 40-B0-34-11-A6-D2
                       DHCP aktiviert. . . . . . . . . . : Ja
                       Autokonfiguration aktiviert . . . : Ja
                       Verbindungslokale IPv6-Adresse  . : fe80::6844:9327:ec81:4731%11(Bevorzugt) 
                       IPv4-Adresse  . . . . . . . . . . : 172.19.101.150(Bevorzugt) 
                       Subnetzmaske  . . . . . . . . . . : 255.255.252.0
                       Lease erhalten. . . . . . . . . . : Donnerstag, 8. Juni 2017 13:20:03
                       Lease l„uft ab. . . . . . . . . . : Freitag, 9. Juni 2017 13:20:03
                       Standardgateway . . . . . . . . . : 172.19.100.1
                       DHCP-Server . . . . . . . . . . . : 172.19.100.9
                       DHCPv6-IAID . . . . . . . . . . . : 54571060
                       DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-20-3C-5E-9A-40-B0-34-11-A6-D2
                       DNS-Server  . . . . . . . . . . . : 172.19.100.9
                                                           172.19.100.10
                       NetBIOS ber TCP/IP . . . . . . . : Aktiviert
                    
                    Drahtlos-LAN-Adapter LAN-Verbindung* 2:
                    
                       Medienstatus. . . . . . . . . . . : Medium getrennt
                       Verbindungsspezifisches DNS-Suffix: 
                       Beschreibung. . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
                       Physische Adresse . . . . . . . . : F4-8C-50-49-D1-AE
                       DHCP aktiviert. . . . . . . . . . : Ja
                       Autokonfiguration aktiviert . . . : Ja
                    
                    Ethernet-Adapter Bluetooth-Netzwerkverbindung:
                    
                       Medienstatus. . . . . . . . . . . : Medium getrennt
                       Verbindungsspezifisches DNS-Suffix: 
                       Beschreibung. . . . . . . . . . . : Bluetooth Device (Personal Area Network)
                       Physische Adresse . . . . . . . . : F4-8C-50-49-D1-B1
                       DHCP aktiviert. . . . . . . . . . : Ja
                       Autokonfiguration aktiviert . . . : Ja
                    
                    Drahtlos-LAN-Adapter WLAN:
                    
                       Medienstatus. . . . . . . . . . . : Medium getrennt
                       Verbindungsspezifisches DNS-Suffix: haan.local
                       Beschreibung. . . . . . . . . . . : Intel(R) Dual Band Wireless-AC 8260
                       Physische Adresse . . . . . . . . : 72-3F-F5-26-FF-6C
                       DHCP aktiviert. . . . . . . . . . : Ja
                       Autokonfiguration aktiviert . . . : Ja
                    

                    Installed Software:
                    alt text

                    Network devices in device manager:
                    alt text

                    ║▌║█║▌│║▌║▌█

                    1 Reply Last reply Reply Quote 0
                    • X
                      x23piracy
                      last edited by x23piracy Jun 8, 2017, 10:59 AM Jun 8, 2017, 4:58 PM

                      @Tom-Elliott @george1421 @Wayne-Workman It looks like the pending macs have stopped accouring since i uninstalled the fog client from the machine it4314, can someone identify something crude in installed software, ipconfig and or network nics? My post before with the Screenshots.

                      ║▌║█║▌│║▌║▌█

                      W T 2 Replies Last reply Jun 9, 2017, 2:17 AM Reply Quote 0
                      • W
                        Wayne Workman @x23piracy
                        last edited by Wayne Workman Jun 8, 2017, 8:18 PM Jun 9, 2017, 2:17 AM

                        @x23piracy This is interesting. Did you only uninstall the fog client, or did you delete the host in fog too? Also, we must remember you put those MACs in the mac filter list as well. All those things are in play still. We need to eliminate variables.

                        Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                        Daily Clean Installation Results:
                        https://fogtesting.fogproject.us/
                        FOG Reporting:
                        https://fog-external-reporting-results.fogproject.us/

                        1 Reply Last reply Reply Quote 0
                        • T
                          Tom Elliott @x23piracy
                          last edited by Jun 9, 2017, 2:19 AM

                          @x23piracy Windows 10 has this feature to “randomize” mac’s to help prevent hijacking of your ip’s. Maybe this is enabled on this machine?

                          Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                          Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                          Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                          W X 3 Replies Last reply Jun 9, 2017, 2:21 AM Reply Quote 2
                          • W
                            Wayne Workman @Tom Elliott
                            last edited by Jun 9, 2017, 2:21 AM

                            @Tom-Elliott Why on earth would they do such a thing.

                            Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                            Daily Clean Installation Results:
                            https://fogtesting.fogproject.us/
                            FOG Reporting:
                            https://fog-external-reporting-results.fogproject.us/

                            T 1 Reply Last reply Jun 9, 2017, 2:45 AM Reply Quote 0
                            • T
                              Tom Elliott @Wayne Workman
                              last edited by Jun 9, 2017, 2:45 AM

                              @Wayne-Workman “In the name of security”

                              Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                              Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                              Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                              1 Reply Last reply Reply Quote 0
                              • X
                                x23piracy @Tom Elliott
                                last edited by Jun 9, 2017, 6:42 AM

                                @Tom-Elliott no since this notebook has been deployed with our image this can’t be enabled, the only option could be the user itself. I’ve never heared about this where can this be enabled/disabled?

                                ║▌║█║▌│║▌║▌█

                                1 Reply Last reply Reply Quote 0
                                • X
                                  x23piracy @Tom Elliott
                                  last edited by Jun 9, 2017, 6:58 AM

                                  @Tom-Elliott @Wayne-Workman the system is currently not in house so i cannot proof this.
                                  I found the option: https://superuser.com/questions/1212736/random-hardware-addresses-in-windows-10-creators-update/1212749

                                  alt text

                                  I will check this if the system is reachable.

                                  Regards X23

                                  ║▌║█║▌│║▌║▌█

                                  1 Reply Last reply Reply Quote 1
                                  • X
                                    x23piracy
                                    last edited by Jun 9, 2017, 3:28 PM

                                    FYI, i don’t know if the random mac stuff is the issue, i could not reach the notebook today user was already gone for the weekend, i will report next week.

                                    ║▌║█║▌│║▌║▌█

                                    1 Reply Last reply Reply Quote 0
                                    • X
                                      x23piracy
                                      last edited by x23piracy Jun 12, 2017, 1:34 AM Jun 12, 2017, 7:32 AM

                                      @Tom-Elliott @Wayne-Workman @george1421 Hey dudes this random mac option for wlan was really enabled, since i didn’t knew it was existing i have to disable this by gpo, this user enabled it on it’s own, he thougth it would be a good idea, no it’s not for FOG 😄 Thank you Tom for giving the solving idea 😉

                                      Where is the option to mark as solved? Can’t find it.

                                      ║▌║█║▌│║▌║▌█

                                      Q 1 Reply Last reply Jun 12, 2017, 8:33 AM Reply Quote 1
                                      • Q
                                        Quazz Moderator @x23piracy
                                        last edited by Jun 12, 2017, 8:33 AM

                                        @x23piracy Mark as solved is only available for moderators and developers and such, to prevent people from solving too early and what not.

                                        1 Reply Last reply Reply Quote 0
                                        • 1
                                        • 2
                                        • 3
                                        • 3 / 3
                                        3 / 3
                                        • First post
                                          44/53
                                          Last post

                                        197

                                        Online

                                        12.0k

                                        Users

                                        17.3k

                                        Topics

                                        155.2k

                                        Posts
                                        Copyright © 2012-2024 FOG Project