ff:ff:00:00:xx:xx wired client MAC address type in Prime Infrastructure 3.1.4 - what is it?

[jakubjakubiak]

I have a riddle to solve:

the wired client view of Prime Infrastructure lists clients by MAC addresses, and a big number of listed MAC addresses (filter -> All) follow the pattern: ff:ff:00:00:xx:xx (e.g ff:ff:00:00:2b:81). They’re almost all disassociated (no IP assigned), and on the same switch port there is often another (active) client having regular MAC and IP addresses

The OUI (FF-FF-00) does not exist in the IEEE file: http://standards-oui.ieee.org/oui.txt

On IANA page it shows the MAC addresses belong to a reserved range: http://www.iana.org/assignments/ethernet-numbers/ethernet-numbers.xhtml

The Wireshark OUI lookup says it’s a Lantastic device: https://www.wireshark.org/tools/oui-lookup.html

I uess it can be some automatically generated MAC used as a placeholder in the absence of real data (e.g. PI keeps a record of a client connected on port X on switch Y on a certain day, but for some reason it doesn't have the actual MAC address). It's a fresh PI deployment and for many of those clients the connection date precedes the PI installation date.

What is the explanation?

[vishal.c07]

Hi jakub,

I was facing same issue in my network, I work on it and I solved it, even TAC engineer not able to solve.

Step 1: If you configure SNMP V3 then add below command per vlan 

snmp-server group NMSNWDEVICE v3 priv context vlan-vlan id.

Step 2: IOS issue

-unknown client is generate by switch and PI receive via SNMP.

-I have 2960+pc-l, 2960-s series and WS-C2960X-24PD-L, I analyse that issue related IOS

upgrade the IOS above 152.2

you'll get result definitely.