Undesirable spoofed MAC addresses on WiFi Extenders
I have two WiFi extenders, an EAX15 and a fairly ancient WNCE3001.
Both of them exhibit the same undesirable behavior. In both cases, I am actually not using them as extenders but merely to provide an ethernet port at a location in my house that is unwired. In both cases, I have a single device connected to the ethernet port of the Netgear extender.
In both cases, when the device attached to the extender is pinged, the extender spoofs the returned MAC address to be the same as the MAC address of the extender. Instead, I want to see the actual MAC address of the attached device.
An example:
Attached device:
IP: 192.1.1.200 Ping: 739 ms Hostname: isy.sci1.com Ports: 80 MAC Address: 84:1B:5E:28:7B:6B
extender:
IP: 192.1.1.252 Ping: 45 ms Hostname: isyaccesspt.sci1.com Ports: 80 MAC Address: 84:1B:5E:28:7B:6B
You can see that the IP addresses are different but the reported MAC addresses are identical. This confuses the heck out of programs that try to monitor for down devices by issuing pings.
I can find no setup options for either device to report the actual MAC address of an attached device. Any way to solve this?
Re: Undesirable spoofed MAC addresses on WiFi Extenders
Thank you for the reply. The article you linked is a bit different than my situation I think, though it is a bit confusing.
The article seems to talk about the the MAC addresses for wireless devices connected to the extender. I am not using the extender that way - the attached devices are connected only to the ethernet port of the adapter, not wirelessly.
The article also seems to say that the attached devices get a virtual MAC address which is different from the MAC address of the extender. That would be fine with me, as long as the MAC address of the attached devices were not the same as the MAC address of the extender. Supplying identical MAC addresses for different IPs is a recipe for confusion.
Do you know the rationale for this strange MAC choice? I can't think of a scenario where it is beneficial.
Re: Undesirable spoofed MAC addresses on WiFi Extenders
the article wasn't the best. You're right.
When the extender is setup as a repeater, virtual mac addresses are how it allows it to connect more devices to the router.
Standard routers (not all) can only connect so many devices to it. Extenders use their mac address (in the router) so the router is only counting it as a single device and then the extender hands out virtual addresses to connected devices.
Thats a simplified way of putting it. Doesn't matter if its over wireless or through the ethernet.
You can search online and see this is a common issue of using extenders with what you're attempting.
Re: Undesirable spoofed MAC addresses on WiFi Extenders
I appreciate the explanation, and your explanation makes sense.
It's too bad this behavior can't be disabled. I have no problems with the number of devices connected to my router, but having the same MAC address show up on different IPs is causing me problems.
Is there a way to suggest to Netgear that they make this an optional behavior?
Re: Undesirable spoofed MAC addresses on WiFi Extenders
If the devices behind the extender are using DHCP from your main router (not the extender) you should see the DHCPDISCOVER/DHCPOFFER/DHCPACCEPT/DHCPACK messages in your log collector. The DHCPDISCOVER will have the actial MAC of the device as its looking for the dhcp server. capture that. Youll then see the dhcpoffer from the DHCP server allocating an IP address to it, and the dhcprequest from the client asking to use it, finally followed by the dhcpack send by the dhcp server saying its given. You can now match IP based on that until the next time it gets a new, you monitoring search should see the change. i use splunk to do this on my home network and it works fine. as i troll the logs from my router, i look for the MAC of the extender, and then run a subsearch of the above for any mac that was assigned an IP to the current IP in the router log.
Thank you for your input and for sharing the link to the NETGEAR support article. While it's true that extenders often exhibit this behavior of spoofing MAC addresses, Y9 it seems the issue here goes beyond the typical operation of a Wi-Fi Range Extender.
The problem isn't just about retrieving the virtual MAC address; it's more about the extender not forwarding the actual MAC address of the connected device. This is causing confusion for network monitoring tools which rely on MAC addresses to identify individual devices.
