Port Security Violations - Rogue MACs?

[harotpa]

Hi,

I currently am experiencing some strange port security violations on ports that are connected to some pretty old cameras. They're all coming from what appear to be junk MAC addresses, like 0000.4006.fcce, 0000.4006.7587, and they're nowhere close to the same MAC scheme as the devices plugged into those ports. The manufacturer of the device's MAC is now defunct and I know of no connection to it. We never had this problem before this week.

Could it be that the cameras are sending these weird MACs? The switches (9300L) currently reside in a locked room with no outside access, so I know no one is plugging in randomly.

The issue is happening on multiple ports that are only involving these Panasonic cameras, which is leading me to believe (hope) that it's just weirdness from them. Apologies if this is too vague lol.

UPDATE: Thanks to those who responded. It looks like they were ghost MAC addresses likely from a firmware issue from these old cameras. Much appreciated!

[liviu.gheorghe]

Hello @harotpa ,

Can you share the logs from the 9300 switches?

Have you tried restarting the cameras connected to the ports which are experiencing security violations?

Can you share the port configuration that are experiencing these issues?

[balaji.bandi]

May be sometime device faulty also give you random MAC address.

0000.4006. - as per looking this is valid looks for me as you look vendor lookup.

check any update required on the end point - or MAB using OUI by listing all the MAC address to temporary fix.

Also contact Vendor for MAC address of the device not correct.

[Leo Laohoo]

---

@harotpa wrote:
UPDATE: Thanks to those who responded. It looks like they were ghost MAC addresses likely from a firmware issue from these old cameras. Much appreciated!

---

@liviu.gheorghe, @balaji.bandi 

[cotersavik]

Hi,

I currently am experiencing some strange port security violations on ports that are connected to some pretty old cameras. They're all coming from what appear to be junk MAC addresses, like 0000.4006.fcce, 0000.4006.7587, and they're nowhere close to the same MAC scheme as the devices plugged into those ports. The manufacturer of the device's MAC is now defunct and I know of no connection to it. We never had this problem before this week.

Could it be that the cameras are sending these weird MACs? The switches (9300L) currently reside in a locked room with no outside access, so I know no one is plugging in randomly.

The issue is happening on multiple ports that are only involving these Panasonic cameras, which is leading me to believe (hope) that it's just weirdness from them. Apologies if this is too vague lol.

[marce1000]

     - Review this discussion : https://ipvm.com/discussions/mac-address-spoofing

 M.

[vishalbhandari]

The strange MAC addresses and the recent onset of the issue suggest that the cameras might be the source of the problem. By isolating and analyzing the traffic, updating firmware, and possibly adjusting port security settings temporarily, you can narrow down the cause. If the cameras are indeed malfunctioning, replacing them might be the most straightforward solution in the long term.

[mohamedlamine]

i totaly agree