I am puzzled as a part-time/hobbyist network manager why some HP 1910-24G switches' MAC addresses have suddenly changed to something else that they are supposed to be, as written on their factory-printed labels. Is it intentional tampering, or is there a logical reason for why the MAC-addresses have changed?

Background and story:

Yesterday I came to check out a LAN party held by local students, giving advice or last minute fixes if needed, and I told them to test the connections and management to each HP 1910-24G switch to check the students' understanding and control over the network in the LAN party space. There was a DHCP configuration running on a routing server that connected the local network to WAN, written years back, that had static IP addresses, combined with clear domain names to control the switches in the LAN party so the students have a more intuitive control over the network. I noticed that some of the static IP addresses were not assigned to the given MAC-addresses, while the students had confirmed that the network is working properly from the LAN-party attendants' perspective. I confirmed that the switches are in place, and that they should have been given a proper IP-address through the DHCP configuration, however, we could not find almost a half of the switches through any ping, tracerouting, or even nmapping even though they were supposed to be in the given .../24 IP space.

A smart student then did a sanity check against a problematic switch's printed-on MAC label, and we ran a check on the DHCP server's lease table, finding no such MAC-address, even though the network worked fine. On a closer examination we found that while the target switch's MAC-address did not match the label, it closely resembled the original, being just one bit off (eg. "...:B5"->"...:B6", and the switch was given an IP address from the regular DHCP address space, easily lost among the hundreds of LAN-partyers' IP addresses.

Since almost half of the same kind of switches had not gotten their given static IP-addresses, based on their MAC-address, I assume that the rest of the switches had a similar situation. The switches were not in day-to-day use, and had been in storage for this kind of events, last time being a year back, unless being used undocumented.

I left the students to examine the network and gave them tasks to find the source of this conundrum, since I had other things to attend to. However I am still puzzled what might have caused this, if not intentional tampering?

  • 1
    I know Switches are known to be intelligent, but this MAC changing intelligence is way too much. XD – C0deDaedalus Mar 24 '18 at 11:27
  • Is the MAC address on an original HP sticker? Because if hand-written than the small error only means a wrong eye-glass prescription for the admin. – harrymc Mar 24 '18 at 12:59

A network switch has multiple ports (and MACs) associated with it. The printed MAC (if only one) is typically just the base number (others will increment from that number). Regardless, all MACs will fall within the vendor OUI (HP in this case).

Two possibilities to check,

  1. Are there multiple up-link ports? Could a different (neighboring) port have been used in this case?

  2. Are VLANs setup on the switches? I am not sure on this one but I think a different VLAN might show up with a different MAC on the switch.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.