Unknown MAC address in unifi network topology

Cyber Security & Hacking
1

I have an unknown MAC address listed in my unifi network topology (looks like an Intel NIC based on the address). When forgotten it returns within several minutes.

It’s listed as attached to the same port that the 10Gbit link to my virtualization server.
However, it is not one of the NICs of that host, nor is it one of the VMs. It’s also not one of the docker containers.

I cannot find this MAC in pfsense DHCP leases, nor can I capture any packets belonging to this MAC using pfsense packet capture on LAN or WAN interfaces. Ntopng also does not have any records of any hosts with this MAC address.

I would be very thankful if someone can point out what I am missing here?

2

I have not gone to this same extent to determine what it was, but I have seen something similar. Also using pfsense and UniFi switches and AP’s. I (maybe naively) assumed it something internal to the switch.

Would be curious to see what others say and what you find out. I can’t see the MAC on my DHCP list, but that is where my investigation stopped.

3

In pfsense check the “Diagnostics” and then ARP Table. If it is in there, start unplugging things until you find it.
https://docs.netgate.com/pfsense/en/latest/monitoring/status/arp.html

4

Thank you Tom. I looked and I cannot find this MAC address there either. This is so puzzling.

1 Like
5

Is it an IPMI address for the virtualization server? The BMC might be sharing that connection, like they often do. And if not set for DHCP it won’t reach out to get an address.

6

Thanks for thinking about it. I should have mentioned that I checked that previously - it’s not the IPMI MAC either. On one hand I’m happy that someone hasn’t immediately figured it out, on the other hand, I think I’m a little frustrated that I still don’t have any idea.

1 Like
7

A month down the line and I still haven’t figured it out. The address is still there, and still no traffic to or from it.

8

I came across this post when searching on google.

I too have a mac address showing up in my topology. After some hunting i discovered it is the 2nd physical nic in my server.

The 1st nic is on vlan 10 and is my windows box and that pc shows up as the pc in my topology.

The 2nd nic is connected to the router under vlan 20, and is dedicated to my vm (ubuntu) running through win 11 pro hyper-v.

The ubuntu vm shows up as a standalone server on the topology, but the 2nd nic mentioned before also shows up as a mac address on vlan 20 and also no traffic stats.

– ive just learnt to live with it. I dont know if this helps you, but i wanted to share.

Screenshot_20230214_223748_Chrome
Screenshot_20230214_223748_Chrome1080×2400 185 KB

Notice the mac at the bottom and the ubuntu are both on port 8… and doing an ipconfig on the windows server showed that the 2nd nic had a 172.x address.