Unknown MAC address showing up under SHARED

Question

Unknown MAC address showing up under SHARED

I'm hoping that someone can explain to me (in not-too-technical terms) how I can ascertain whether I have an intruder on my home network.

My network comprises three different Macs. My G5 iMac, a G4 PowerBook and a MacMini. All are running OS X 10.5.4. I set up my network using AirPort Express and I have use WPA2 security.

I'm concerned because when I look at the Finder sidebar using my iMac I see under 'Shared' the G4 PowerBook and then a reference to a 'mac000d93b0efbe' - I don't know what this mac address is

I've checked the MAC addresses for each of my computers using the 'About This Mac' under the Apple menu but none of my computers has a MAC address like this - in fact, my machines all start with '00:11:24' (which I'm guessing identifies them as Apple machines).

If I do have an intruder on my network, how do I get rid of it?

Presently I only have Printer sharing enabled (on all machines) but I'm at a loss to work out what the 'alien' Mac address is? I have my iMac connected via Ethernet to a Belkin router - however, the MAC address on the bottom of the router doesn't match the address above either.

I would be grateful for any suggestions!

Cheers
Tricia

2GHz 20-inch iMac G5 (ALS), Mac OS X (10.5.4), 1.42GHz G4 Mini; 12-inch G4PowerBook; 500GB Lacie f/w hd; Video iPod; iPod mini;

Posted on Oct 12, 2008 5:48 AM

Reply

Answer 1

BobHarris

Level 9

56,933 points

Oct 12, 2008 8:01 AM in response to Patricia Henwood

On each of your machines, use
Applications -> Utilities -> Network Utility -> Info
and cycle through all the *Network Interfaces* checking the *Hardware Address*, which will be of the form nn:nn:nn:nn:nn:nn
and see if it matches 00:0d:93:b0:ef:be.

You will have to click on the *Network Interfaces* pop-up menu to select alternate interfaces to check their MAC addresses.

Alternately, you can look in
System Preferences -> Network
Select each interface, and click Advanced and look at the Ethernet tab. Repeat for each interface. Actually a lot more clicking.

Or from Applications -> Utilities -> Terminal use the ifconfig command. It will list all your network interfaces at once. You then have to dig through the output to find the MAC addresses.


ifconfig
or
ifconfig | grep ether

If you have VMware or Parallels installed it will create a virtual ethernet interface.

And of course you have an ethernet MAC address as well as an Airport MAC address.

However, if you have in intruder, change your WAP2 password. That would knock the intruder off the LAN for a little while. If you did that and the address stayed, you could fairly sure that it was one of your systems as only you could get the new WAP2 password to your systems so quickly.

NOTE: It is not easy to crack WAP2. They would have to do some serious computing and or be very lucky guessing to crack it quickly.

Reply

Answer 2

BobHarris

Level 9

56,933 points

Oct 12, 2008 8:08 AM in response to Patricia Henwood

You will be happy to know that the vendor code for that MAC address is Apple Computer:


00-0D-93 (hex) Apple Computer
000D93 (base 16) Apple Computer
 1 Infinite Loop
 Cupertino CA 95014
 UNITED STATES

So you can eliminate checking any non-Apple hardware in your home.

Reply

Answer 3

Oct 12, 2008 3:42 PM in response to BobHarris

Bob,

Thank you so much for your prompt and informative reply. I followed your suggestion to use the Network Utility app and, sure enough, the mac address in question showed up for the Network Interface (en0) on the G4 PowerBook! Problem solved :-))

I must admit I was completely bamboozled because I had attempted to track down the mac address for each of my computers using 'About This Mac' but that only confused me more because it then became obvious that there are different mac addresses for the same machine depending on whether one looks at Airport ID, Ethernet or FireWire - as they say ...'a little knowledge ...

Thank you once more

Cheers
Tricia

Reply