Computer getting 4 new mac address daily
-
3 weeks ago one pc I have started to get 3-5 mac address daily. He had massive pending new mac address in two weeks. none of them are same. I replace his computer thinking it was a pc problem. Two days after I replace it, now it is starting up again. I check what he has installed. It is the same software I put on it two days ago. He not a hacking and does not know computers. He types up his work orders on it.
Suggestions? -
@jhalbert Here’s the script:
https://github.com/FOGProject/fog-community-scripts/tree/master/delete-extra-macs-on-host
Set the variables at the top, and set it to run on a schedule in cron. -
@jhalbert If this is a windows 10 box, there is a feature somewhere in the config settings where the it will generate a random mac address for its network adapters. This is a nasty and not very usefulness feature for fog. @x23piracy Did you have this with a system at your site?
-
@george1421 hi, yes we did. a user enabled this on his own and we had’nt disabled that feature by gpo.
Maybe useful for people very often work in public wlan networks but for fog it’s contra productive.https://winaero.com/blog/enable-random-mac-address-in-windows-10-for-wi-fi-adapter/
The old thread: https://forums.fogproject.org/topic/10209/about-50-pending-macs-for-one-host-beware-of-windows-10-random-mac-feature-for-wlan/33
Regards X23
-
#wiki worthy
-
It is windows 7. If he plugs his cell phone and turns on hot spot. Will it pick up the mac from that? I think he might be plugging in a device that talks with Cars. I think these mac address are from the car themselves or the device that he is using. I did some google searching on the mac address that is in that list. I came up with nothing. The mac address appear to be computer created. I check all the mac address that system produce and found that 15 chars is used to make them all up.
-
@jhalbert can you please present a bunch of the macs the device is producing?
-
@jhalbert did you read the links that x23 posted below? I’m almost certain you have the exact same problem that the below links address.
-
@wayne-workman i was also feeling to ask if all has been read.
-
@wayne-workman I did. I am running windows 7 and not windows 10.
-
@jhalbert then you’re going to need to troubleshoot what’s going on by keeping a very close eye on the pending MACs list, and when a new MAC appears for this computer, just call the person and ask them what did they just do. Report back with what you find and we’ll try to help solve this.
-
WMI usually has details about any network devices. It logs the service name, mac address, adapter type, device name, etc…
What about making a script that logs any new network devices (that have MACs) and having it run periodically with a scheduled task? Might help you track down the cause.
-
Hi,
remember when i had my problem @tom-elliott had rumors about bluetooth devices that do things like that.
Is there a BT device in that system? Can you try to disable it and have a look if you still get macs?Any special software that’s handling virtual network devices?
I hardly recommend you to read the whole thread here:
https://forums.fogproject.org/topic/10209/about-50-pending-macs-for-one-host-beware-of-windows-10-random-mac-feature-for-wlan?page=1For me it was the wifi mac stuff but we talked about possible other causes, please confirm that you read all.
Regards X23
-
I’m a little speculative on the idea that this machine is not Windows 10. That doesn’t mean Windows 7 didn’t have a similar “feature” but this really sounds like the “Random MAC address” feature of Windows 10. You really need to find that machine.
-
@x23piracy yes on Bluetooth. I will check that out
-
@tom-elliott I check, that location has only 1 windows 10. It is in a different department. Company wide I only have 8 computers running windows 10. Only this site is having this as a problem. In the corp office I am using 10 and so is other people. We don’t see this problem. Some suggest that it could be a Bluetooth device. I think these computers have Bluetooth but I need to check. The person that is using this pc is not techy at all. He needs help with even the basic things. He calls us twice a week. He told me shutdown means to turn off the screen and turn it back on. For him to use Bluetooth would be far out their.
-
@wayne-workman Watching Fog is little hard to do. I have asked what he is doing but he tells me how he is doing his job. Is their a way to see what time these appear at? These guys write down everything they do per car they work on. I could use that to figure out what happen during the time the mac request appeared
-
@jhalbert said in Computer getting 4 new mac address daily:
Is their a way to see what time these appear at?
There are ways. I’ve written ugly monitors before, look at this for an example: https://github.com/FOGProject/fog-community-scripts/tree/master/MonitorFogStorageNodes
-
@wayne-workman I talk to the manager of this person today about what he does. I guess he using a very old tool and it needs the internet read the error codes. Everyone else is using laptops that we gave them. I guess all these macs I have is from the cars themselves. With this massive list of Mac address, does it hurt Fog to have a list of macs that is 50 plus long? To it is just lines in my database?
-
@jhalbert said in Computer getting 4 new mac address daily:
With this massive list of Mac address, does it hurt Fog to have a list of macs that is 50 plus long? To it is just lines in my database?
Well if you know it’s always going to be related to that one individual computer that employee is using, you could setup a daily cron job to delete other MACs associated with the host. This way, you don’t have to deal with it and the DB stays clean.
-
@wayne-workman sure that sounds like a plan. Do you have a script already for this?
