I am puzzled as a part-time/hobbyist network manager why some HP 1910-24G switches' MAC addresses have suddenly changed to something else that they are supposed to be, as written on their factory-printed labels. Is it intentional tampering, or is there a logical reason for why the MAC-addresses have changed?
Background and story:
Yesterday I came to check out a LAN party held by local students, giving advice or last minute fixes if needed, and I told them to test the connections and management to each HP 1910-24G switch to check the students' understanding and control over the network in the LAN party space. There was a DHCP configuration running on a routing server that connected the local network to WAN, written years back, that had static IP addresses, combined with clear domain names to control the switches in the LAN party so the students have a more intuitive control over the network. I noticed that some of the static IP addresses were not assigned to the given MAC-addresses, while the students had confirmed that the network is working properly from the LAN-party attendants' perspective. I confirmed that the switches are in place, and that they should have been given a proper IP-address through the DHCP configuration, however, we could not find almost a half of the switches through any ping, tracerouting, or even nmapping even though they were supposed to be in the given .../24 IP space.
A smart student then did a sanity check against a problematic switch's printed-on MAC label, and we ran a check on the DHCP server's lease table, finding no such MAC-address, even though the network worked fine. On a closer examination we found that while the target switch's MAC-address did not match the label, it closely resembled the original, being just one bit off (eg. "...:B5"->"...:B6", and the switch was given an IP address from the regular DHCP address space, easily lost among the hundreds of LAN-partyers' IP addresses.
Since almost half of the same kind of switches had not gotten their given static IP-addresses, based on their MAC-address, I assume that the rest of the switches had a similar situation. The switches were not in day-to-day use, and had been in storage for this kind of events, last time being a year back, unless being used undocumented.
I left the students to examine the network and gave them tasks to find the source of this conundrum, since I had other things to attend to. However I am still puzzled what might have caused this, if not intentional tampering?