Device MAC address shows as gateway MAC address

[srbank]

Hello,

I have noticed while scanning over the WAN that some devices at our other offices show their correct MAC address, while others show the MAC address of our local gateway. PCs display the correct address, as well as Canon printers. Our HP printers and some other devices list the wrong MAC address. Has anyone else seen this?

Thanks.

[Komodo Support]

I think I know what your problem is.  There are a few different ways a network scanner can retrieve the MAC address.  One is by ARP (arp -a in DOS) after pinging/accessing the device.  This works for all LANs on the same segment(s) or when properly bridged.  For Windows PCs, you can also use NetBIOS to get the MAC, which is nbtstat -a [IP] in DOS, in addition to ARP.  Then on some printers or devices with SNMP, a MAC address can be retrieve through that protocol if the MAC isn't available in the ARP Table.  There are a few other methods we're working to add now, but those are the main three.

So what's going on here is that ARP (Address Protocol Resolution) isn't being used over your WAN.  In some cases, the ARP Table (again, arp -a in DOS) on your local PC will be filled with the MAC address of the gateway/router in order to comply with protocol standards.  NEWT doesn't yet filter these out, so that's why you see duplicate MACs.  This issue is very common with WANs, but there should be a way to enable or add ARP support through your WAN hardware/software settings.  In any case, you now know what to look for.

Please let us know if you have any other questions.

[srbank]

Thank you for your quick reply. I think I get what you're saying but I'll have to go through it a couple of times.
If all devices showed the local gateway MAC, I would get that. But I'm confused as to why some devices show the proper MAC and some don't?

Thanks again.

[Komodo Support]

That's just it.  NEWT, like similar apps, will use the ARP Cache by default to get the MAC, which is in this case will always be your router's MAC.  But, if the NetBIOS port is available (again, try 'nbtstat -a [IP Here]' in DOS), NEWT will use that instead, because it's more reliable.  And if SNMP is available, it may use it to get the MAC.  If it's a device that doesn't have a NetBIOS port or SNMP, it should then show your router's MAC because the ARP Cache is being used, and in your case, your ARP Table is being "poisoned" by your WAN setup.  As far as we know, there are ways to make ARP work over a WAN.

If you'd like please email us a copy of an MRF saved out of NEWT.  Please Zip it if over a couple megabytes.  We'd then be able to see what you're seeing and could possibly give a better explanation through example.

[srbank]

Thank you very much for your reply. Using the ARP default without NetBIOS or SNMP makes sense. I would appreciate you having a look at one of our MRF files. Where/how do I send it? (just over 2MB)

[Komodo Support]

No problem.  Just email it to our support email address on our Contact page:

http://www.komodolabs.com/contact-us