Short answer: It is not off by 1 digit.
The base or "primary" MAC address of most routers is the MAC address of the WAN interface, not the LAN that you see in your ARP command. This is completely normal behavior. Each "interface" will have a unique MAC address, this is even more obvious in enterprise grade routers where each address of the router for each individual LAN will have a unique MAC address, sometimes dozens of MAC addresses for one device.
Incrementing the MAC is common actually quite common, many higher end routers are laid out like so:
- WAN1: 11:22:33:44:55:66
- WAN2: 11:22:33:44:55:67
- LAN1: 11:22:33:44:55:68
- LAN2: 11:22:33:44:55:69
- LAN3: 11:22:33:44:55:70
- LAN4: 11:22:33:44:55:7A
- 2.4Ghz WiFi: 11:22:33:44:55:7B
- 5Ghz WiFi: 11:22:33:44:55:7C
If you where connected to the LAN connected to LAN3 and performed an ARP -a you would see your gateway's address is associated with MAC
11:22:33:44:55:70 whereas someone connected to LAN1 might see
11:22:33:44:55:68 as the gateway's MAC address.
Note that in most home routers, there are two MAC address, one for the WAN and one for the LAN. So looking at the MAC table of the first router upstream for yours would see the WAN address (
11:22:33:44:55:66 if using the above example) and all devices on any LAN port may see the same MAC address as well (
11:22:33:44:55:68 for example). Exactly how these are laid out and used are often device dependent and different manufacturers handle it in different ways.
In any of the above scenarios, the MAC address printed on the box and the one on the sticker of the device is likely it's base MAC, which would be
11:22:33:44:55:66 in this case, even though it uses multiple MAC addresses.