SRX Services Gateway
Highlighted
SRX Services Gateway

Smartphone MAC Address changing?

‎10-29-2014 06:24 AM

In my SRX logs, I've noticed an excessive number of KERN_ARP_ADDR_CHANGE messages.  What I've noticed is that maybe one MAC address in the string I can lookup, for example 90:18:7c is a Samsung.  However, it then appears to roll through MAC addresses that on the surface do not belong to anyone (ie e8802e)...at leat according to http://coffer.com/mac_find.  Eventually, it rolls back to Samsung, but the last bit of the MAC changes there too.    My lease time is in days.  

 

Can anyone shed some light on what I'm looking at?

 

Oct 29 06:57:40 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 90:18:7c:8a:ca:4e to e8:80:2e:8f:b7:70
Oct 29 07:08:11 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from e8:80:2e:8f:b7:70 to 24:a2:e1:bc:63:57
Oct 29 07:15:29 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 24:a2:e1:bc:63:57 to 8c:29:37:13:a1:42
Oct 29 07:20:50 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 8c:29:37:13:a1:42 to 78:fd:94:8e:79:5e
Oct 29 07:23:35 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 78:fd:94:8e:79:5e to 28:37:37:c9:8a:8d
Oct 29 07:33:43 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 28:37:37:c9:8a:8d to 6c:40:08:21:3d:e3
Oct 29 07:44:30 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 6c:40:08:21:3d:e3 to b0:9f:ba:7a:11:57
Oct 29 07:55:19 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from b0:9f:ba:7a:11:57 to 90:18:7c:82:b3:3d
Oct 29 07:57:39 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 90:18:7c:82:b3:3d to b4:18:d1:60:de:be
Oct 29 08:09:51 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from b4:18:d1:60:de:be to 24:ab:81:d2:e8:db
Oct 29 08:19:00 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 24:ab:81:d2:e8:db to f8:27:93:84:21:63
Oct 29 08:27:24 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from f8:27:93:84:21:63 to 08:70:45:4e:17:0a
Oct 29 08:38:35 MHHS-JSR4350 /kernel: KERN_ARP_ADDR_CHANGE: arp info overwritten for 10.151.48.40 from 08:70:45:4e:17:0a to 60:92:17:5a:d1:5e

1 REPLY 1
Highlighted
SRX Services Gateway
Solution
Accepted by topic author cbrun
‎08-26-2015 01:27 AM

Re: Smartphone MAC Address changing?

‎10-29-2014 06:57 AM

Hi there,

IOS 8 does that but supposedly only when "scanning" for Wifi

http://qz.com/218437/a-tiny-technical-change-in-ios-8-could-stop-marketers-spying-on-you/

But one can do it on Android as well if so inclined

https://play.google.com/store/apps/details?id=com.wireless.macchanger&hl=en

HTH

Thanks
Alex

_____________________________________________________________________

Please ask Your Juniper account team about Juniper Professional Services offerings.
Juniper PS can design, test & build the network/part of the network as per Your requirements

+++++++++++++++++++++++++++++++++++++++++++++

Accept as Solution = cool !
Accept as Solution+Kudo = You are a Star !