nanog mailing list archives
Mystery MAC address
From: JoeSox <joesox () gmail com>
Date: Fri, 8 Jul 2022 09:22:27 -0700
Hello, I have something I have never seen before and was wondering if anyone in the community has seen something like this? So some active directory accounts are getting locked intermittently and I had to do some sniffing and I have an IP address showing up in a non-used subnet 10.1.2.x And it shows an unrecognized MAC address. This virtual machine is in a Nutanix environment. I am trying to figure this out without bringing in paid outside help. Thanks in advance for any responses. c2:ea:e4:c5:57:e6 is the MAC in question. I don't fully understand this request. 10.1.2.18 is the mystery ip that doesn't ping, 10.1.3.9 is the DC. AD Audit provides nonexistent machines making the requests and even blank. "User account 'Administrator' was locked from computer ''." [image: image.png] -- Thank You, Joe
Current thread:
- Mystery MAC address JoeSox (Jul 08)
- Re: Mystery MAC address Christopher Morrow (Jul 08)
- Re: Mystery MAC address heasley (Jul 08)
- Re: Mystery MAC address Brandon Svec via NANOG (Jul 08)
- Re: Mystery MAC address Saku Ytti (Jul 08)
- Re: Mystery MAC address Crist Clark (Jul 08)
- Re: Mystery MAC address Saku Ytti (Jul 08)
- Re: Mystery MAC address William Herrin (Jul 08)
- Re: Mystery MAC address JoeSox (Jul 08)
- Re: Mystery MAC address Christopher Morrow (Jul 08)