12

My application queries mac-addresses of client computers where it runs and stores them on the server. When I analysed the server DB, I found that some mac-addresses repeat 100-150 times. I.e. different client computers in different unrelated organizations have the same macs. So some mac-addresses are very "popular". They also somehow appear in google results. E.g. 58-2C-80-13-92-63. Why does it happen?

Details: my app runs on Windows, client computers belong to different organizations and are situated in different cities. And my app connects to the web-server where it stores some statistics (e.g. mac-addresses).

Martin Schröder
  • 323
Mike Siomkin
  • 223
  • 1
  • 8

2 Answers2

17

This example in particular (58-2C-80-13-92-63) is a USB Ethernet chip made by Huawei. Looks like they're being lazy and reusing the MAC. Examples from Google:

[50413.229125] cdc_ether 2-1:1.0: eth1: register 'cdc_ether' at usb-0000:00:1d.7-1, CDC Ethernet Device, 58:2c:80:13:92:63

…

[  122.660069] huawei_cdc_ncm 3-3:1.1 wwan0: register 'huawei_cdc_ncm' at usb-0000:00:14.0-3, Huawei CDC NCM device, 58:2c:80:13:92:63

The others could also be a case of VMs being passed around. But the most likely explanation (as others have said) is that it's cheap hardware.

To suss this out, check to see whether the MAC is (marked as) globally unique or locally administered: https://en.wikipedia.org/wiki/MAC_address#Address_details

The address 58:2c:80:13:92:63 in theory should be globally unique:

0x58 → 1011000

But MACs from VMs (e.g. 58:2c:80:13:92:63) won't be:

0x52 → 1010010
MikeyB
  • 40,079
-2

You can see different mac-addresses only in local network. When IP packet go trough router the mac-address of source host is changed to mac-address of router's output interface. That is why you can see many IP addresses (witch are not from your local network) with the same mac-address.

Mikhail Khirgiy
  • 2,133