MAC address changed spontaneously

[tronh]

Dell Gold support thinks I'm insane. Sorry for the length of the post, but it's a bit involved.

Troubleshooting a network issue on a Dell Optiplex SX260 Ultra Small Form Factor with integrated Intel PRO/1000MT ethernet adapter. Machine has a history of complaining on startup "Windows has recovered from a serious error", but sending error report to Microsoft yields no clues. Yesterday, an application that requires the LANA number of the NIC to be 0 started to complain. Ran the LANACFG.EXE utility to diagnose. LANA 0 was assigned to "TCP/IP -> Intel PRO/1000 MT". LANA 1 was assigned to "TCP/IP -> Intel PRO/1000 MT #2". Checked network connections -- the only adapter shown was "Intel PRO/1000MT #2". Used LANACFG to reassign LANA 0 to the correct adapter, and that fixed my application error.

Started trying to figure out why the NIC definition changed. Noticed IP address also changed, even though I had a DHCP reservation for this machine. Went to DHCP Manager on the server -- found the computer name twice -- once with the original MAC address and IP (reserved) and a new lease and IP with a completely different MAC address. So the different MAC address explains why Windows assigned a new NIC definition and LANA number, and why DHCP handed out a new IP. But the mystery is why the MAC address changed. Dell says it is impossible -- the MAC address is burned into ROM and cannot be changed. It can be spoofed temporarily in the driver (with the right utilities) but cannot be physically changed. And this is an integrated, soldered-to-the-motherboard NIC, so it can't be physically swapped.

I have 6 identical machines on the network, so the first few digits of the MAC address are all the same (manufacturer ID, I think): 00-0D-56
Original MAC: 00-0D-56-C8-6F-71
New MAC: 40-83-66-A6-01-80

I think it's a hardware problem, but Dell is not budging unless it happens again. Anybody seen this one before??

 

[bil4hire]

Found this manufacturer for the original mac here:
http://network.programming-in.net/articles/MAC.asp?Company=Dell PCBA Test
Dell mac of course.

But didn't find any manufacturer that starts with 40-83-66

Not sure what to tell you

 

[kingttx]

Holy cow, we had the same problem. One of my duties is Technical Service Resource for our Purchasing department. Two days ago, we had a power brownout that reset everyone's computers. When we rebooted, we eventually found two of us (including my computer) had spontaneously changed the MAC address to the exact same new MAC you listed in 2004.

Our Telecom & Networking folks keep thinking this is impossible, the same response Dell gave you. Come to find out, it's not! Do you know if network cards have some kind of default MAC address to fall back on in case the ROM gets blitzed? Also, can you remember if you had any kind of electrical spike or drop that reset your computer?

Regards,
Tom

 

[kingttx]

Well, one of our technology guys figured out how to fix the issue without masking the MAC address or re-burning the NIC's ROM. We turned off both machines and unplugged the power source. It seems NICs will still pull power even with the machine off, so unplugging the power reset the MAC back to its original burn.

All is well!
Tom