Devices with MAC’s manufacturer section “00:FF:01”

mac addressnetwork-monitoring

While monitoring my office's network, I have seen a huge amount of traffic coming from devices whose MAC address manufacturer part (the three most significant octets) is 00:FF:01 I can't see the client part, but this prefix is showing ~50% more traffic than any other device from any other manufacturer.

I haven't been able to find who's the manufacturer of such a device, or whether is some kind of virtual device (all the queries out there return a No manufacturer found for that prefix)

I'm not even sure if ServerFault is the right place to ask this, but I'm running out of options. Does anyone knows what type of device is that? Are they virtual devices?

Thank you in advance.

EDIT 1:

Running WireShark I was able to find the whole MAC of one of these things: 00:FF:01:FF:02:FF (it really looks weird for a MAC address). For the last… 30 mins or so, only that particular MAC address seems to be sending traffic. I don't know for sure if all the hits I saw before (the ones where I could only see the manufacturer part) were coming from the same 00:FF:01:FF:02:FF, or if there's a possibility there were other devices with the same manufacturer 00:FF:01 but they're not transmitting now.

Best Answer

I'm just guessing, but we recently had storms of strange packets which Wireshark didn't understand, either. After a few days a coworker noticed that the packets make more sense and look like IPv6/Ethernet Multicast packets if you remove the first 16 bytes. (Seeing 33:33 somewhere later in the byte stream looked familiar...)

In our case it were Apple Thunderbolt displays with an integrated network adapter which caused these packets. Looks like a bug in their firmware. With those 16 bytes, the source MAC address always was 00:02:01:00:00:00 and the destination MAC address always was 00:00:00:00:b7:00 which both look suspiciously not-random.

So maybe you want to check if your packets make more sense, too, if you remove a few bytes from the beginning.

If not: Any chance that you can capture some of these packets and post them here, e.g. in pcap format?

Related Topic