Hi,
I recently started fooling around with my Mikrotik RB2011UAS-2HnD (v5.25).
And when browsing some options and logs, I came across this weird MAC address…
00:0E:00:00:00:01
NIC vendor “Atrie”?
Sometimes I see this MAC address popping up as source, sometimes as destination.
But I don’t know where this MAC is coming from.
Here’s some data from the packet capture.
Time 3.028 s
Interface ETH01-WAN
Direction rx
Src. MAC Address 00:0E:00:00:00:01
Dst. MAC Address 00:05:8B:63:A2:C0
VLAN ID
Src. Address 0.0.0.0
Dst. Address 0.0.0.0
Protocol 2054 (arp)
IP Protocol
Size 60
IP Packet Size 0
IP
IP Header Size 0
TOS 0
Fragment Offset 0
TTL 0
Identification 0
Time 3.028 s
Interface ETH01-WAN
Direction tx
Src. MAC Address 00:05:8B:63:A2:C0
Dst. MAC Address 00:0E:00:00:00:01
VLAN ID
Src. Address 0.0.0.0
Dst. Address 0.0.0.0
Protocol 2054 (arp)
IP Protocol
Size 42
IP Packet Size 0
IP
IP Header Size 0
TOS 0
Fragment Offset 0
TTL 0
Identification 0
and In the firewall logs, I always see it as a source MAC…
input: in:ETH01-WAN out:(none), src-mac 00:0e:00:00:00:01, proto TCP (RST), 173.194.65.95:443->37.251.x.x:46676, len 40)
Does anyone know where this weird MAC is coming from?
Thanx in advance.