Unknown MAC address in unifi network topology

I have an unknown MAC address listed in my unifi network topology (looks like an Intel NIC based on the address). When forgotten it returns within several minutes.

It’s listed as attached to the same port that the 10Gbit link to my virtualization server.
However, it is not one of the NICs of that host, nor is it one of the VMs. It’s also not one of the docker containers.

I cannot find this MAC in pfsense DHCP leases, nor can I capture any packets belonging to this MAC using pfsense packet capture on LAN or WAN interfaces. Ntopng also does not have any records of any hosts with this MAC address.

I would be very thankful if someone can point out what I am missing here?

I have not gone to this same extent to determine what it was, but I have seen something similar. Also using pfsense and UniFi switches and AP’s. I (maybe naively) assumed it something internal to the switch.

Would be curious to see what others say and what you find out. I can’t see the MAC on my DHCP list, but that is where my investigation stopped.

In pfsense check the “Diagnostics” and then ARP Table. If it is in there, start unplugging things until you find it.
https://docs.netgate.com/pfsense/en/latest/monitoring/status/arp.html

Thank you Tom. I looked and I cannot find this MAC address there either. This is so puzzling.

1 Like

Is it an IPMI address for the virtualization server? The BMC might be sharing that connection, like they often do. And if not set for DHCP it won’t reach out to get an address.

Thanks for thinking about it. I should have mentioned that I checked that previously - it’s not the IPMI MAC either. On one hand I’m happy that someone hasn’t immediately figured it out, on the other hand, I think I’m a little frustrated that I still don’t have any idea.

1 Like