14

I'm not new to home networking and I've been running DD-WRT routers for years. I'm a software developer, so "technologically" curious by nature but admittedly have never really researched in-depth low level technical details of networking.

I'm probably being paranoid and plan on doing further research and learning on my own, but I've been seeing strange things on my home network lately. The one I wanted to ask about here was regarding private MAC Addresses. By that I mean when I look up the MAC Address through the DD-WRT OUI Lookup, it's designated as private.

Google knows all, but I can't really find anything in plain English about typical use or scenarios where they would be used. I have a private MAC address showing up on my LAN with a DHCP assigned IP address that I haven't been able to identify.

I've used NMap pointed at the IP associated with the "private" MAC address but it can't identify anything about it either. It cannot identify the vendor/manufacturer, the O/S, or anything else. I'm looking for any information that may be useful in helping me understand where and what this device may be.

Other info: I've recently updated the WPA2 password from pretty secure to 13+ character length after seeing a "ghost" (aka evil twin) access point/SSID that I also can't identify. Additionally, for now (even though I know it's not a secure solution) I've filtered the offending "private" MAC address from accessing my home networks.

  • Have you tried and OUI Lookup to at least find the manufacturer? – heavyd Apr 29 '15 at 23:01
  • 1
    How did you nmap a MAC address? Did you find it in your ARP table, so you have a mapping to an IP address? Describe your network, possibly connected devices, and provide the first 6 digits (OUI) of the address please. – armani Apr 29 '15 at 23:17
  • Do you have Apple mobile devices on the network? They now dynamically assign MAC addresses. – Julian Knight Apr 29 '15 at 23:20
  • I'll answer all 3 at once... The MAC Address lookup of the router uses OUI Lookup - it's what designated/defined it as a "Private" mac address. Next it has an assigned IP address on my network and NMAP cannot determine vendor/manufacturer, O/S, etc. and last YES alas we do have apple mobile devices on the network... I just can't isolate what device this is. – Jeff Apr 29 '15 at 23:37
8

Private registrations are either MA-L, MA-M, or MA-S assignments from the IEEE to an entity that has paid an additional initial fee and/or an annual recurring fees to the IEEE to prevent their name and address from showing up in the public listing. More details of MA-L listings as an example can be found at the IEEE site.

There is no way to determine the manufacturer of this device from the OUI unless you have access to the private list. You will need to locate and/or identify this device by other means.

Just to be clear, this is in no way related to locally administered MAC addresses which is indicated by the second bit transmitted, specifically the second least significant bit for Ethernet.

  • 1
    I just revisited this and got to wondering would a locally administered MAC address also appear as "private" on the OUI search? Or, does it appear as private due to the specific MAC address range? – Jeff May 4 '15 at 18:29
  • I would guess this would depend on how the OUI lookup is programmed, starting with what it is using as it's source followed by any built in logic. Local addresses do not show up on the public list of registered OUIs from the IEEE (they are not registered) and private listings show up as private. For instance, testing a number of tools with a MA-M listing (such as 0C-EF-AF) commonly results in IEEE (MA-L listing), some will return PRIVATE (MA-M listing) and a few gave no result. When testing local addresses, most resulted in no result and only one actually reported it as a local. – YLearn May 4 '15 at 19:36
11

Private MAC addresses are often found in embedded systems that do not have an official address. Many cheap "credit card computers" such as the Raspberry Pi must generate their own address to operate without an official, manufacturer-assigned address.

For you interest: Private MAC addresses can be identified by having the second-least-significant bit of the most significant byte set. (And as unicast addresses, they must not have the least significant bit set.) That means any addres matching any pattern below is private.

x2:xx:xx:xx:xx:xx
x6:xx:xx:xx:xx:xx
xA:xx:xx:xx:xx:xx
xE:xx:xx:xx:xx:xx

To find what and where your ghost device actually is, I suggest looking for small computers and embedded electronics. A less likely possibility is an intruder in your network with a spoofed MAC address.

And lastly, what actually is your question? ;)

  • Well I guess since I couldn't find any real relevant info on Google, or, forums regarding this type of MAC address as it relates to my situation my question was as I generally described, "I'm looking for any information that may be useful in helping me understand where and what this device may be". It's generic and general but so is the scope at this point! – Jeff Apr 29 '15 at 23:41
  • btw, thanks for that info... may wind up being useful however the private mac address as designated by OUI lookup doesn't fall into any of those address patterns... it's frustrating because other than technical specifications I don't find much of anything regarding these. – Jeff Apr 30 '15 at 0:18
  • @Peter I took the liberty of removing multicast/broadcast addresses from your list. I hope that's okay. If not, feel free to revert my edit. – Spiff Apr 30 '15 at 0:21
  • 6
    This answer refers to "locally administered" MAC addresses, not private MAC addresses. The two concepts are separate and are often mixed up by the use of the term private in association with the similar concept for IP addressing. – YLearn Apr 30 '15 at 2:22
  • FWIW, my Raspberry Pi has a MAC address beginning with B8-27-EB, which is registered to "Raspberry Pi Foundation" – David C. Apr 10 at 14:58
7

I had the same issue, a "private" MAC suddenly showed up in my router table. I discovered that this appeared whenever my Kindle device was turned on and signed onto my network talking to Amazon. It's apparently something Amazon is doing related to the Kindle.since this appears to be normal behavior when using the Kindle, I am no longer concerned by its' appearance. My secret spy concern is gone.

  • 1
    I had a similar problem...but tracked it down to an Amazon Fire TV Stick my wife had started using a while ago. Oddly enough, it showed up in my router's Device Table as a Kindle device, which led me down a rabbit hole, sadly. I want those two hours of my life back! – Digger Mar 15 '17 at 21:00
-1

Your DVR, DirecTV/Dish/Comcast/=Insert name= television set might also show up on networks as private. Mine happens to.

-1

FYI MAC address can be local or universal. Local MAC addresses are called as private addresses. Most significant bit of MAC address is used to identify universal or local address.

  • Incorrect. Private MAC addresses are addresses assigned to an organization that has paid additional fees to maintain their listing as "Private". Please see my answer above for more detail. – YLearn Feb 26 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.