Dell printer MAC address changing

K

kjpetrie

My security e-mail contained the following this morning (addresses hidden):
Code: 
master6.evenas.org kernel log messages:
+arp: 192.168.x.y moved from aa:aa:aa:aa:aa:aa to bb:bb:bb:bb:bb:bb on re0
+arp: 192.168.x.y moved from bb:bb:bb:bb:bb:bb to aa:aa:aa:aa:aa:aa on re0
+arp: 192.168.x.y moved from aa:aa:aa:aa:aa:aa to bb:bb:bb:bb:bb:bb on re0
+arp: 192.168.x.y moved from bb:bb:bb:bb:bb:bb to aa:aa:aa:aa:aa:aa on re0
+arp: 192.168.x.y moved from aa:aa:aa:aa:aa:aa to bb:bb:bb:bb:bb:bb on re0
The device concerned is a Dell C1760nw printer (a rebadged Xerox, I believe) which contains a WiFi interface (not used) and an Ethernet one which is. It was switched on for around 10 minutes to print from another machine and seems to have changed its MAC address several times. Just wondered whether it's just a peculiarity of the printer or whether something else should be suspected.
 
IP conflict is the most common reason. Are you sure the Wifi isn't active? You could get similar messages if it flips between wired and wireless.
 
That's the obvious answer, but there is no other device on the LAN with the same IP address or the other MAC. If the printer's switched off, there's no response to a ping and the router and arp show nothing.

The Wifi interface has the same MAC as the Ethernet, according to the printer's http interface! Don't ask me how that's possible. I have tried with the WiFi Enabled and Disabled, though I have not set up the WPA key, so it can't connect anyway.

It's all something of a mystery.
 
Are the MAC addresses significantly different? Especially the first three bytes? Looking up the IEEE OUI can be quite enlightening.

www.wireshark.org

Wireshark · OUI Lookup Tool

Wireshark: The world's most popular network protocol analyzer
www.wireshark.org www.wireshark.org

Is there possibly one or more routers in between the printer and the host? Remember that the MAC address of the router is used as a source/destination on the network between the router and the host. So if the traffic arrives from two different routers the MAC address would constantly change to each of the router's MAC addresses.
 
Yes, the printer's MAC, as reported by its web interface, begins 08:00:37 and belongs to FUJIFILM Business Innovation Corp.. The other address begins 64:6c:80, and belongs to CHONGQING FUGUI ELECTRONICS CO.,LTD.

The networking arrangement is a little complicated as the modem/router is in a room downstairs and hidden away where no one can access it to protect it from a disabled child who can't resist pressing buttons or unplugging leads. That is cabled up to my study where an old D-link router with which I have lost administrative contact acts as a bridge connecting the router to three other devices - my FreeBSD server, my Linux desktop, and the Dell printer. I don't know how that router is configured as it won't respond to attempts to log into it, and I can't even see it on the network, but it enables all the devices to see each other and communicate.

There are also five WiFi devices in the house but they are all DHCP-allocated and there are no conflicts there.
 
You must log in or register to reply here.
Back
Top