SRX

 View Only

IMPORTANT MODERATION NOTICE

This community is currently under full moderation, meaning  all posts will be reviewed before appearing in the community. Please expect a brief delay—there is no need to post multiple times. If your post is rejected, you'll receive an email outlining the reason(s). We've implemented full moderation to control spam. Thank you for your patience and participation.



  • 1.  Smartphone MAC Address changing?

    Posted 10-29-2014 06:25

    In my SRX logs, I've noticed an excessive number of KERN_ARP_ADDR_CHANGE messages.  What I've noticed is that maybe one MAC address in the string I can lookup, for example 90:18:7c is a Samsung.  However, it then appears to roll through MAC addresses that on the surface do not belong to anyone (ie e8802e)...at leat according to http://coffer.com/mac_find.  Eventually, it rolls back to Samsung, but the last bit of the MAC changes there too.    My lease time is in days.  

     

    Can anyone shed some light on what I'm looking at?

     

    Oct 29 06:57:40 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 90:18:7c:8a:ca:4e to e8:80:2e:8f:b7:70
    Oct 29 07:08:11 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from e8:80:2e:8f:b7:70 to 24:a2:e1:bc:63:57
    Oct 29 07:15:29 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 24:a2:e1:bc:63:57 to 8c:29:37:13:a1:42
    Oct 29 07:20:50 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 8c:29:37:13:a1:42 to 78:fd:94:8e:79:5e
    Oct 29 07:23:35 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 78:fd:94:8e:79:5e to 28:37:37:c9:8a:8d
    Oct 29 07:33:43 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 28:37:37:c9:8a:8d to 6c:40:08:21:3d:e3
    Oct 29 07:44:30 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 6c:40:08:21:3d:e3 to b0:9f:ba:7a:11:57
    Oct 29 07:55:19 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from b0:9f:ba:7a:11:57 to 90:18:7c:82:b3:3d
    Oct 29 07:57:39 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 90:18:7c:82:b3:3d to b4:18:d1:60:de:be
    Oct 29 08:09:51 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from b4:18:d1:60:de:be to 24:ab:81:d2:e8:db
    Oct 29 08:19:00 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 24:ab:81:d2:e8:db to f8:27:93:84:21:63
    Oct 29 08:27:24 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from f8:27:93:84:21:63 to 08:70:45:4e:17:0a
    Oct 29 08:38:35 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 08:70:45:4e:17:0a to 60:92:17:5a:d1:5e


    #arp
    #MACAddress


  • 2.  RE: Smartphone MAC Address changing?
    Best Answer

    Posted 10-29-2014 06:58

    Hi there,

    IOS 8 does that but supposedly only when "scanning" for Wifi

    http://qz.com/218437/a-tiny-technical-change-in-ios-8-could-stop-marketers-spying-on-you/

    But one can do it on Android as well if so inclined

    https://play.google.com/store/apps/details?id=com.wireless.macchanger&hl=en

    HTH

    Thanks
    Alex