Score:0

MAC address mysteriously changed

de flag

I have a computer used for backups that does a wake-on-lan to run backups and then turns off. This morning something happened that caused the MAC address to change. While I know the MAC address can be changed, I didn't think this could happen without asking.

This computer has been running Ubuntu and getting updated since 16.04. It is currently on Ubuntu 20.04.3 LTS. At some point eth0 became enp2s0 but I can't imagine why that would have changed the MAC. The Ethernet port is build into the motherboard. The computer only runs for 20-60 minutes a day and does nothing else. It hasn't moved or had hardware modifications in years. It has been a solid backup system--monitored but otherwise ignored because it just works--the kind of reliability I've come to expect from a Ubuntu machine.

Any ideas on what might have caused this? Could some update have caused this? A hardware issue? If so, how would I find out?

EDIT: The original MAC address was 00:1a:4d:5e:7e:85 and the new address is aa:4c:ca:15:7e:97. The two are not even close to one another and hard to explain by a bit flip in EEPROM. The original address shows Giga-Byte Tech as the vendor (as expected, it is a Giga-Byte motherboard). The new address has no vendor and looks to be completely random.

EDIT: As requested, the output of several commands.

$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether aa:4c:ca:15:7e:97 brd ff:ff:ff:ff:ff:ff
    inet 10.4.8.210/16 brd 10.4.255.255 scope global noprefixroute enp2s0
       valid_lft forever preferred_lft forever
    inet6 fe80::82a3:395:882b:844a/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
$ ls -l /etc/netplan/
total 0
$ sudo cat /etc/netplan/*
cat: &apos;/etc/netplan/*&apos;: No such file or directory
$ sudo ls -l /etc/NetworkManager/system-connections/
total 0
$ sudo cat /etc/NetworkManager/system-connections/*
cat: &apos;/etc/NetworkManager/system-connections/*&apos;: No such file or directory
$ sudo grep -lR "aa:4c:ca:15:7e:97" /etc 2>/dev/null

$ sudo grep -R -C 4 "aa:4c:ca:15:7e:97" /etc  2>/dev/null

$

In addition, I booted the system using SystemRescue.

[root@sysrescue ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether aa:4c:ca:15:7e:97 brd ff:ff:ff:ff:ff:ff
    inet 10.4.8.210/16 brd 10.4.255.255 scope global noprefixroute enp2s0
       valid_lft forever preferred_lft forever
    inet6 fe80::fd62:c737:4f9c:80fe/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

Clearly, the hardware MAC has changed and it isn't Ubuntu setting this address each time the system boots. How and why the hardware MAC changed is still a mystery.

2022-02-28

After physically removing the power cord from the computer, the MAC address returned to the original. While I had power cycled the computer several times, I had not removed the power cord. The NIC must get power even when the rest of the machine is powered down in order to allow the wake-on-LAN functionality. Whatever caused this problem did so in a temporary way.

Jeff avatar
mx flag
Does anyone else other than you have access to your machine?
Jeff avatar
mx flag
This might help: https://www.linuxfordevices.com/tutorials/ubuntu/spoof-mac-address It talks about how to change or spoof MAC address, but it may provide some insight... This may also help: https://ubuntuforums.org/showthread.php?t=2451515
A. Que avatar
de flag
@Jeff No one else has access to that machine--just the backup user and admin user. Physically there is access to the machine, but judging from the dust, it hasn't been touched in a long time.
Tilman avatar
cn flag
The medium (typically flash memory) storing the MAC address isn't perfect. Bit flips and even complete loss do happen. If you'd share the old and new MAC address by adding it to your question we might have a look to see whether there's an explainable pattern in the change.
A. Que avatar
de flag
@Tilman I have added the MAC address as requested. I would agree that bit flips and loss happen, but in that case I would expect a similar MAC or all FF or 00.
Tilman avatar
cn flag
That is indeed strange. I'm at a loss.
Score:0
br flag

Please, add the output of these commands (in separated parts) to your question above:

ip addr
ls -l /etc/netplan/
sudo cat /etc/netplan/*
sudo ls -l /etc/NetworkManager/system-connections/
sudo cat /etc/NetworkManager/system-connections/*
sudo grep -lR "aa:4c:ca:15:7e:97" /etc 2>/dev/null
sudo grep -R -C 4 "aa:4c:ca:15:7e:97" /etc  2>/dev/null

There is an easy way to separate the system setup problem from the hardware problem. Boot your computer using a USB FLASH disk with live Linux image and check the MAC address of the Ethernet interface. If the MAC remains aa:4c:ca:15:7e:97, then it is probably a HW issue. If the MAC switches back to 00:1a:4d:5e:7e:85, then a bad MAC is set somewhere in your installed Ubuntu system.

A. Que avatar
de flag
I had added the requested information. Booting with a live disk shows the new MAC address, so it has clearly been set. How and why is still unknown. Not enough reputation in this forum to up-vote your answer, but thanks all the same.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.