Wednesday, March 4, 2020

Unknown MAC

A strange MAC just popped-up in a port-security alert.

7e:7e:7e:Removed

I can't seem to find any vendor info on the 7e7e7e OUI.

Did some internet searching and came up empty handed, perhaps someone here has an idea.

This isn't mission critical, just curiosity.

**EDIT**

Going to consider this Case Closed for now.

Likely that this is related to the endpoint doing jitter testing. I'm seeing some semi-periodic port-sec. blocks on the same port from seemingly random MAC address' containing variations of the jitter test patterns described here.

Going to continue to dig into the specs. of the host device that is connected and try to verify if it's designed to and attempting to perform these tests/checks.

Big Thanks to u/youngeng for the lead!



No comments:

Post a Comment