• Recent
    • Unsolved
    • Tags
    • Popular
    • Users
    • Groups
    • Search
    • Register
    • Login

    About 50 Pending macs for one host? Beware of Windows 10 random MAC feature for WLAN!

    Scheduled Pinned Locked Moved Solved
    FOG Problems
    5
    53
    14.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Tom ElliottT
      Tom Elliott @x23piracy
      last edited by

      @x23piracy we need to found it why it thinks it’s it4314 first.

      Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

      Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

      Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

      x23piracyX 1 Reply Last reply Reply Quote 0
      • x23piracyX
        x23piracy @Tom Elliott
        last edited by x23piracy

        @Tom-Elliott sorry i really would do this but i am a little bit lost with it 😞 what should i do next? any help is appreciated.

        ║▌║█║▌│║▌║▌█

        Tom ElliottT 1 Reply Last reply Reply Quote 0
        • Tom ElliottT
          Tom Elliott @x23piracy
          last edited by

          @x23piracy You can look in the access log and hopefully see the host that applied this mac address.

          Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

          Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

          Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

          x23piracyX 1 Reply Last reply Reply Quote 0
          • x23piracyX
            x23piracy @Tom Elliott
            last edited by

            @Tom-Elliott

            172.19.101.150 - - [08/Jun/2017:13:18:25 +0200] "GET /fog/management/index.php?sub=requestClientInfo&mac=40:B0:34:11:A6:D2%7CF4:8C:50:49:D1:AE%7CF4:8C:50:49:D1:B1%7CD2:B1:A5:D6:12:7C&newService&json HTTP/1.1" 200 1705 "-" "-"
172.19.101.150 - - [08/Jun/2017:13:18:27 +0200] "GET /fog/service/usertracking.report.php?action=login&user=it4314%5Ccca&mac=40:B0:34:11:A6:D2%7CF4:8C:50:49:D1:AE%7CF4:8C:50:49:D1:B1%7CD2:B1:A5:D6:12:7C&newService&json HTTP/1.1" 200 583 "-" "-"
172.19.101.150 - - [08/Jun/2017:13:20:37 +0200] "GET /fog/management/index.php?sub=requestClientInfo&mac=40:B0:34:11:A6:D2%7CF4:8C:50:49:D1:AE%7CF4:8C:50:49:D1:B1%7CD2:B1:A5:D6:12:7C&newService&json HTTP/1.1" 200 1705 "-" "-"
172.19.101.150 - - [08/Jun/2017:13:23:08 +0200] "GET /fog/management/index.php?sub=requestClientInfo&mac=40:B0:34:11:A6:D2%7CF4:8C:50:49:D1:AE%7CF4:8C:50:49:D1:B1%7CD2:B1:A5:D6:12:7C&newService&json HTTP/1.1" 200 1705 "-" "-"
172.19.101.150 - - [08/Jun/2017:13:24:19 +0200] "GET /fog/management/index.php?sub=requestClientInfo&mac=40:B0:34:11:A6:D2%7CF4:8C:50:49:D1:AE%7CF4:8C:50:49:D1:B1%7CD2:B1:A5:D6:12:7C&newService&json HTTP/1.1" 200 1705 "-" "-"
172.19.101.150 - - [08/Jun/2017:13:26:44 +0200] "GET /fog/management/index.php?sub=requestClientInfo&mac=40:B0:34:11:A6:D2%7CF4:8C:50:49:D1:AE%7CF4:8C:50:49:D1:B1%7CD2:B1:A5:D6:12:7C&newService&json HTTP/1.1" 200 1705 "-" "-"

            172.19.101.150 belongs to IT4314 🙂 hrhr

            ║▌║█║▌│║▌║▌█

            1 Reply Last reply Reply Quote 0
            • Tom ElliottT
              Tom Elliott
              last edited by

              So what we know, so far, is it appears IT4314 IS registering these pending macs?

              Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

              Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

              Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

              1 Reply Last reply Reply Quote 0
              • x23piracyX
                x23piracy @Tom Elliott
                last edited by

                @Tom-Elliott after chatting with tom we decided to remove the fog client from it4314, i also removed all the pending macs again. Now lets wait what happens.

                ║▌║█║▌│║▌║▌█

                1 Reply Last reply Reply Quote 0
                • x23piracyX
                  x23piracy
                  last edited by

                  @Tom-Elliott Information about IT4314

                  ipconfig /all

                  
Windows-IP-Konfiguration

   Hostname  . . . . . . . . . . . . : it4314
   Prim„res DNS-Suffix . . . . . . . : haan.local
   Knotentyp . . . . . . . . . . . . : Hybrid
   IP-Routing aktiviert  . . . . . . : Nein
   WINS-Proxy aktiviert  . . . . . . : Nein
   DNS-Suffixsuchliste . . . . . . . : haan.local
                                       carbolite.local

Ethernet-Adapter Ethernet:

   Verbindungsspezifisches DNS-Suffix: haan.local
   Beschreibung. . . . . . . . . . . : Intel(R) Ethernet Connection I219-LM
   Physische Adresse . . . . . . . . : 40-B0-34-11-A6-D2
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja
   Verbindungslokale IPv6-Adresse  . : fe80::6844:9327:ec81:4731%11(Bevorzugt) 
   IPv4-Adresse  . . . . . . . . . . : 172.19.101.150(Bevorzugt) 
   Subnetzmaske  . . . . . . . . . . : 255.255.252.0
   Lease erhalten. . . . . . . . . . : Donnerstag, 8. Juni 2017 13:20:03
   Lease l„uft ab. . . . . . . . . . : Freitag, 9. Juni 2017 13:20:03
   Standardgateway . . . . . . . . . : 172.19.100.1
   DHCP-Server . . . . . . . . . . . : 172.19.100.9
   DHCPv6-IAID . . . . . . . . . . . : 54571060
   DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-20-3C-5E-9A-40-B0-34-11-A6-D2
   DNS-Server  . . . . . . . . . . . : 172.19.100.9
                                       172.19.100.10
   NetBIOS ber TCP/IP . . . . . . . : Aktiviert

Drahtlos-LAN-Adapter LAN-Verbindung* 2:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
   Physische Adresse . . . . . . . . : F4-8C-50-49-D1-AE
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Ethernet-Adapter Bluetooth-Netzwerkverbindung:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Bluetooth Device (Personal Area Network)
   Physische Adresse . . . . . . . . : F4-8C-50-49-D1-B1
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Drahtlos-LAN-Adapter WLAN:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: haan.local
   Beschreibung. . . . . . . . . . . : Intel(R) Dual Band Wireless-AC 8260
   Physische Adresse . . . . . . . . : 72-3F-F5-26-FF-6C
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

                  Installed Software:
                  alt text

                  Network devices in device manager:
                  alt text

                  ║▌║█║▌│║▌║▌█

                  1 Reply Last reply Reply Quote 0
                  • x23piracyX
                    x23piracy
                    last edited by x23piracy

                    @Tom-Elliott @george1421 @Wayne-Workman It looks like the pending macs have stopped accouring since i uninstalled the fog client from the machine it4314, can someone identify something crude in installed software, ipconfig and or network nics? My post before with the Screenshots.

                    ║▌║█║▌│║▌║▌█

                    Wayne WorkmanW Tom ElliottT 2 Replies Last reply Reply Quote 0
                    • Wayne WorkmanW
                      Wayne Workman @x23piracy
                      last edited by Wayne Workman

                      @x23piracy This is interesting. Did you only uninstall the fog client, or did you delete the host in fog too? Also, we must remember you put those MACs in the mac filter list as well. All those things are in play still. We need to eliminate variables.

                      Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                      Daily Clean Installation Results:
                      https://fogtesting.fogproject.us/
                      FOG Reporting:
                      https://fog-external-reporting-results.fogproject.us/

                      1 Reply Last reply Reply Quote 0
                      • Tom ElliottT
                        Tom Elliott @x23piracy
                        last edited by

                        @x23piracy Windows 10 has this feature to “randomize” mac’s to help prevent hijacking of your ip’s. Maybe this is enabled on this machine?

                        Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                        Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                        Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                        Wayne WorkmanW x23piracyX 3 Replies Last reply Reply Quote 2
                        • Wayne WorkmanW
                          Wayne Workman @Tom Elliott
                          last edited by

                          @Tom-Elliott Why on earth would they do such a thing.

                          Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG!
                          Daily Clean Installation Results:
                          https://fogtesting.fogproject.us/
                          FOG Reporting:
                          https://fog-external-reporting-results.fogproject.us/

                          Tom ElliottT 1 Reply Last reply Reply Quote 0
                          • Tom ElliottT
                            Tom Elliott @Wayne Workman
                            last edited by

                            @Wayne-Workman “In the name of security”

                            Please help us build the FOG community with everyone involved. It's not just about coding - way more we need people to test things, update documentation and most importantly work on uniting the community of people enjoying and working on FOG! Get in contact with me (chat bubble in the top right corner) if you want to join in.

                            Web GUI issue? Please check apache error (debian/ubuntu: /var/log/apache2/error.log, centos/fedora/rhel: /var/log/httpd/error_log) and php-fpm log (/var/log/php*-fpm.log)

                            Please support FOG if you like it: https://wiki.fogproject.org/wiki/index.php/Support_FOG

                            1 Reply Last reply Reply Quote 0
                            • x23piracyX
                              x23piracy @Tom Elliott
                              last edited by

                              @Tom-Elliott no since this notebook has been deployed with our image this can’t be enabled, the only option could be the user itself. I’ve never heared about this where can this be enabled/disabled?

                              ║▌║█║▌│║▌║▌█

                              1 Reply Last reply Reply Quote 0
                              • x23piracyX
                                x23piracy @Tom Elliott
                                last edited by

                                @Tom-Elliott @Wayne-Workman the system is currently not in house so i cannot proof this.
                                I found the option: https://superuser.com/questions/1212736/random-hardware-addresses-in-windows-10-creators-update/1212749

                                alt text

                                I will check this if the system is reachable.

                                Regards X23

                                ║▌║█║▌│║▌║▌█

                                1 Reply Last reply Reply Quote 1
                                • x23piracyX
                                  x23piracy
                                  last edited by

                                  FYI, i don’t know if the random mac stuff is the issue, i could not reach the notebook today user was already gone for the weekend, i will report next week.

                                  ║▌║█║▌│║▌║▌█

                                  1 Reply Last reply Reply Quote 0
                                  • x23piracyX
                                    x23piracy
                                    last edited by x23piracy

                                    @Tom-Elliott @Wayne-Workman @george1421 Hey dudes this random mac option for wlan was really enabled, since i didn’t knew it was existing i have to disable this by gpo, this user enabled it on it’s own, he thougth it would be a good idea, no it’s not for FOG 😄 Thank you Tom for giving the solving idea 😉

                                    Where is the option to mark as solved? Can’t find it.

                                    ║▌║█║▌│║▌║▌█

                                    Q 1 Reply Last reply Reply Quote 1
                                    • Q
                                      Quazz Moderator @x23piracy
                                      last edited by

                                      @x23piracy Mark as solved is only available for moderators and developers and such, to prevent people from solving too early and what not.

                                      1 Reply Last reply Reply Quote 0
                                      • 1
                                      • 2
                                      • 3
                                      • 1 / 3
                                      • First post
                                        Last post

                                      163

                                      Online

                                      11.6k

                                      Users

                                      17.1k

                                      Topics

                                      154.6k

                                      Posts
                                      Copyright © 2012-2024 FOG Project