Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The university I attend scans student and faculty machines with an agent (Bradford) to ensure they comply with policy (i.e. AV is installed and up-to date, and the OS is patched). The system's MAC address is then tied to a user's domain account. Sometime last week, the campus network started claiming that my laptop was unregistered after a reboot.

I contacted a network admin, who discovered that five different MAC addresses had been associated with my laptop's WNIC. Upon further investigation, I discovered that somehow, the last two hex digits of the WNIC MAC that is reported to Windows 7 has started to change after a reboot of the system. I don't use any spoofing software.

Could this be caused by faulty hardware? The MAC prefix (00E04C) does correspond the correct OEM (Realtek). The WNIC is a RTL8723AE. My next step is to see if the same thing occurs when booted to a Linux distro.

share|improve this question

migrated from Feb 20 '13 at 2:16

This question came from our site for information security professionals.

While related to a security function of your university, this sounds more like a system troubleshooting question. It is probably more appropriate for Super User. If you would like it moved, please flag it for the moderators to migrate - do not cross-post. – Iszi Feb 20 '13 at 1:47
I would just pick one and configure the interface to use that one from now on. – David Schwartz Feb 20 '13 at 2:28
@DavidSchwartz, I'm still curious about this. I've never seen anything like what OP reports. Any sane explanation? – vonbrand Feb 20 '13 at 4:18
@DavidSchwartz Unfortunately, the Windows drivers do not offer that setting, and Linux support is practically nonexistent. I'd rather not use a workaround anyway. I've ordered an Intel 6235AN as a replacement, which I should have tomorrow. – Sean W. Feb 20 '13 at 22:02
@vonbrand My first thought was this might be a symptom of some malware (for ARP Spoofing or something). After I got my paranoia in check, I decided that the most likely explanation a failure in the WNIC hardware. I'll post an update once I've replaced it. – Sean W. Feb 20 '13 at 22:14
up vote 0 down vote accepted

I replaced the WNIC, and all is well.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .