MAC address change

[alphawolf]

I have a T60 and recently reinstalled Windows XP. At work, we require people to register their MAC address to get a DHCP address, and so I registered the MAC address on the bottom of my computer (the wired one), and happily used my laptop all day.

Then something happened, where my MAC address changed, to something completely different. (the original preface is 001641, the new one is 001E37). I have no idea how or why it changed. All I did was install ThinkVantage Access Connections 5.2.

I have a static IP assigned to my Thinkpad, and I don't want to have to keep changing my registration because of my MAC address. Any ideas why it might have changed, and how to change it back (I didn't see anything in the Advanced Properties page in the driver). Thanks!

[rkawakami]

Both MAC prefixes are assigned to USI, a Taiwan company. Maybe it's a question of your system switching to the wireless card? That MAC address should also be somewhere on your system. If you can get to a DOS window, try this command:

ipconfig /all

ref: http://standards.ieee.org/regauth/oui/oui.txt (a very long list)
ref: http://spacehopper.org/oui/001E37 (a much faster way; change the last six characters in the URL for the MAC address you want to look up)

[alphawolf]

Wish it were that simple. The wireless is a completely different MAC address from the two others. (0016CF).

[rkawakami]

Are there any other ethernet adapters plugged into the system? Software to spoof the MAC address? I'm not sure of the capabilities of Access Connections as I don't use it so sorry for the simple queries . What about the ipconfig output? Is there a 00:1E:37 device listed?

[alphawolf]

That's the thing, it's a vanilla XP install, working fine on Monday. No additional hardware, and it shows the new MAC instead of the old one under the same description as before. No spoofing software, nothing. I suppose I will try removing access connections (I like it because it does auto switching between interfaces, and I use my laptop in several different locations consistently, and it manages things like default printers, firewall settings, IP settings, etc). I'm just tired of reinstalling XP (six times in a week, don't ask why).

[rkawakami]

Poking around the net I seem to find that the MAC address is stored in the Windows Registry. Some say that you can find the registry key and change it. There's also this program:

http://devices.natetrue.com/macshift/

that spoofs whatever address you want.

[alphawolf]

Yeah, I saw that, thanks. My question is less how to change it than why it changed, since if it changed once, it can change again, unless it's as simple as removing Access Connections. If it is, then I will just register the new MAC and be done with it. Just want to know why though so I can prevent it from happening again randomly.

[rkawakami]

I don't know why AC would operate like that, but if removing it changes the MAC back to what it was and re-installing it again alters the address (hopefully the same 00:1E:37 one), then that must be the culprit. You can change the MAC address under the Windows Networking manager. Right-click the appropriate entry in the Network Connections window and choose Properties. In the General tab, click on Configure. Click the Advanced tab and under Locally Administered Address, click the Value button and enter the MAC address you want Windows to report. Use no colons or dashes for the MAC address (i.e., 001E37123456).

[alphawolf]

Oh, there it is... I was looking for it under Network Address. I'll just force it and be done with it. Thanks for the help! (I'll probably try AC to see if it was the culprit, but not tonight...) I'll report back if it was AC.

[jdhurst]

You can change the MAC address with Access Connections, but in NO case ever in my long experience with Access Connections has it changed a MAC address without asking. .... JDH

[spuddog]

I have to agree with JD, I don't see how access connections would change a MAC address. I have used SMAC to change my address (for informational purposes only). I would tend to believe there is some malware or virus involved
here.

Scott

[alphawolf]

Definitely not malware, it's a fresh XP install (complete drive wipe), and oddly enough, the same "new" MAC address was there back in September (it is in my list of registered MAC addresses at work). So it's not random, it has some meaning. And to what end would malware want to change your MAC address. MAC addresses are not sent over the 'net, they're local only.

[mazzinia]

Mmmmm,

MAC addresses are in theory unique and are stored in the firmware of the network card. The numbers are assigned by the factory, not by an operating system... true they can be changed, and the main idea behind it is to bypass some security setting to access a network.

Note that they can be changed also permanently inside the chip...

Said this, it's indeed quite strange that a value is altered this way