Multiple MAC address on a single Access Port?

[Marc Abaya]

I'm trying to map our network and I stumbled into this issue where I'm seeing three MAC address connected to a single port. I checked it and it's not connected to another switch. It's connected to a Host PC and from the looks of it it's running both LINUX and WINDOWS. 

Here's the ouput of show mac add table on the 2960 switch:

dsw#show mac address-table | include Gi1/0/42

10 001f.290e.ea1f DYNAMIC Gi1/0/42

10 bed7.a3a5.aacc DYNAMIC Gi1/0/42

10 caee.5871.63cc DYNAMIC Gi1/0/42

I login to the host PC and run ipconfig all and it's showing me this mac add (I deleted other stuff):

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . : caas.local
Description . . . . . . . . . . . : Realtek RTL8139C+ Fast Ethernet NIC #2
Physical Address. . . . . . . . . : 5A-63-09-BA-D2-B3

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8139C+ Fast Ethernet NIC
Physical Address. . . . . . . . . : CA-EE-58-71-63-CC

As you can see I can see the two MAC add but I can't find the third one: bed7.a3a5.aacc.

Any ideas where it is coming from? I already cleared the table but it will still show up.

Thanks.

[ronaldocz]

Hi Marc Abaya ,

It seems to be the management address from a HP Computer. Usually server has this management interface like HP ILO.

Best regards
Ronaldo Czelusniak

[pwwiddicombe · Accepted solution]

Running VMWare to run both at the same time?  The other thing to check is that they don't have some form of Linksys or other switch between switchport and PC.

[jamiebutterworth2016]

Marc's said that the PC is connected directly to the switchport though so there's no switch inbetween.

[Marc Abaya]

Thanks all for the feedback. I found out that this server is actually running Xenserver with multiple virtual server instances. I'm just surprise that the guy who set this up didn't set the switch port to "trunk" as what we usually do..

[premkumarjm]

Hi,

As you said, the host PC is running on both linux and windows. kindly boot the linux os and try the ifconfig -a and share the results.

BR

Prem

[jamiebutterworth2016]

So we know the windows host has at least 2 mac addresses. The one ending in 63cc which matches the switch's mac address table. I'm not sure where d2b3 has come from though as this isn't in the mac address table.

Therefore ea1f and aacc are unknowns. As the above said, please could you post the mac addresses of the linux host? I suspect it will end in either ea1f or aacc. Is the linux host a virtual machine on the windows box?

[devils_advocate]

Could be a virtual interface, especially if its running Vmware or virtualbox etc.