From: BitTwister@mouse-potato.com   
      
   On Fri, 30 Jun 2023 10:52:33 -0400, Jonathan N. Little wrote:   
   > Bit Twister wrote:   
   >> On Thu, 29 Jun 2023 23:26:57 -0400, Jonathan N. Little wrote:   
   >>> Henry Crun wrote:   
   >   
   >   
   >   
   >>>>   
   >>>> Looking up d4:3d:7e:b6:ba:a8 I see vendor is Micro-Star Int'L Co.   
   >>>   
   >>> Which makes sense because it is an MSI motherboard. IIRC that was the   
   >>> MAC address that I originally had the dhcp server trap to set the IP.   
   >>>   
   >>>>   
   >>>> Looking up 1e:2b:ad:33:12:64 (three separate web sites) I get "No such   
   >>>> vendor,  Locally administered addresses (LAA): the address is assigned   
   >>>> to a device by a network administrator"   
   >>>   
   >>> Which is strange because last night it switched to this MAC:   
   >>>   
   >>> jonathan@kenny:~$ ip link show enp3s0   
   >>> 2: enp3s0:  mtu 1500 qdisc fq_codel   
   >>> state UP mode DEFAULT group default qlen 1000   
   >>>     link/ether 1e:2b:ad:33:12:64 brd ff:ff:ff:ff:ff:ff permaddr   
   >>> c6:51:bd:c3:b2:ab   
   >>>   
   >>> So the MAC is currently 1e:2b:ad:33:12:64. Now the above has a   
   >>> "permaddr" value of c6:51:bd:c3:b2:ab. Googling seems to indicate   
   >>> "permaddr" is present when overriding NIC's MAC by spoofing. 1) I am not   
   >>> spoofing. 2) c6:51:bd:c3:b2:ab also has no vendor ID.   
   >>>   
   >>> So I when looking to see where|what could be overriding the MAC like so   
   >>> legacy config since this system has been migrated over the years from   
   >>> earlier versions of Ubuntu.   
   >   
   >   
   >   
   >> I would try booting a live cd and checking just to have a second   
   >> opinion about mac.   
   >>   
   >   
   > Duh! Great idea to eliminate any possible configuration issues... my yumi thumbdrive>   
   >   
   > Well, this is puzzling. The non-MSI vendor MAC "1e:2b:ad:33:12:64" is   
   > showing here in the live session:   
   >   
   > ubuntu@ubuntu:~$ ip link show enp3s0   
   > 2: enp3s0:  mtu 1500 qdisc fq_codel   
   > state UP mode DEFAULT group default qlen 1000   
   >     link/ether 1e:2b:ad:33:12:64 brd ff:ff:ff:ff:ff:ff   
   >   
   > Same as normal boot:   
   >   
   > jonathan@kenny:~$ ip link show enp3s0   
   > 2: enp3s0:  mtu 1500 qdisc fq_codel   
   > state UP mode DEFAULT group default qlen 1000   
   >     link/ether 1e:2b:ad:33:12:64 brd ff:ff:ff:ff:ff:ff permaddr   
   > ee:a5:38:4c:ed:67   
   >   
   > Only difference is the normal boot includes the permaddr parameter   
   > ee:a5:38:4c:ed:67. Also strange is this permaddr parameter changed from   
   > yesterday where it was "c6:51:bd:c3:b2:ab" not "ee:a5:38:4c:ed:67"   
      
   Personally I would be nervous/parodied and do a clean install   
   assuming you are talking about a wired Ethernet device.   
      
   Going to update my custom sys_audit script to check mac addys   
      
   I found a few bits of interesting information here   
   https://superuser.com/questions/349579/what-can-cause-a-mac-address-to-change   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)