Why do some mac-addresses repeat so often

mac addressnetworking

My application queries mac-addresses of client computers where it runs and stores them on the server. When I analysed the server DB, I found that some mac-addresses repeat 100-150 times. I.e. different client computers in different unrelated organizations have the same macs. So some mac-addresses are very "popular". They also somehow appear in google results. E.g. 58-2C-80-13-92-63. Why does it happen?

Details: my app runs on Windows, client computers belong to different organizations and are situated in different cities. And my app connects to the web-server where it stores some statistics (e.g. mac-addresses).

Best Answer

This example in particular (58-2C-80-13-92-63) is a USB Ethernet chip made by Huawei. Looks like they're being lazy and reusing the MAC. Examples from Google:

[50413.229125] cdc_ether 2-1:1.0: eth1: register 'cdc_ether' at usb-0000:00:1d.7-1, CDC Ethernet Device, 58:2c:80:13:92:63

…

[  122.660069] huawei_cdc_ncm 3-3:1.1 wwan0: register 'huawei_cdc_ncm' at usb-0000:00:14.0-3, Huawei CDC NCM device, 58:2c:80:13:92:63

The others could also be a case of VMs being passed around. But the most likely explanation (as others have said) is that it's cheap hardware.

To suss this out, check to see whether the MAC is (marked as) globally unique or locally administered: https://en.wikipedia.org/wiki/MAC_address#Address_details

The address 58:2c:80:13:92:63 in theory should be globally unique:

0x58 → 1011000

But MACs from VMs (e.g. 58:2c:80:13:92:63) won't be:

0x52 → 1010010
Related Topic