The tale of a single MAC

Sun Jan 2 22:26:54 UTC 2011

On Sat, Jan 01, 2011 at 09:33:46PM -0600, Graham Wooden wrote:
> Hi there,
> 
> I encountered an interesting issue today and I found it so bizarre  so I
> thought I would share it.
> 
> I brought online a spare server to help offload some of the recent VMs that
> I have been deploying.  Around the same time this new machine (we¹ll call it
> Server-B) came online, another machine which has been online for about a
> year now stopped responding to our monitoring (and we¹ll name this
> Server-A). I logged into the switch and saw that the machine that stopped
> responding was in the same VLAN as this newly deployed, and then quickly
> noticed that Server-A¹s MAC address was now on Server-B¹s switch port.
> ³What the ...² was my initial response.
> 
> I went ahead and moved Server-B¹s to another VLAN, updated the switchport,
> cleared the ARP, and Server-A came back to life.  Happy new year to me.
> 
> So  here is the interesting part... Both servers are HP Proliant DL380 G4s,
> and both of their NIC1 and NIC2 MACs addresses are exactly the same.  Not
> spoofd and the OS drivers are not mucking with them ... They¹re burned-in 
> I triple checked them in their respective BIOS screen.  I acquired these two
> machines at different times and both were from the grey market.  The ³What
> the ...² is sitting fresh in my mind ...  How can this be?
> 
> In the last 15 years of being in IT, I have never encountered a ³burned-in²
> duplicated MACs across two physically different machines.  What are the
> odds, that HP would dup¹d them and that both would eventually end up at my
> shop?  Or maybe this type of thing isn¹t big of deal... ?

We got a batch of NICS that had duplicate MACs in several pallets of
IBM desktops, about 15 years back. We noticed this only when two of the
machines were shipped to the same field office location.

I've heard other state agencies talk about the same sort of problem with
IBM and several other vendors. 

-- 
Mike Andrews, W5EGO
mikea at mikea.ath.cx
Tired old sysadmin 