A question about MAC Address

I have always thought that a MAC Address was hardware encoded and therefore permanently fixed to that specific hardware item.

At home I have a Network Monitor installed which monitors both Ethernet and WiFi. The internal IP addresses and MAC addresses are correctly displayed by the Network Monitor for the devices using the Broadband Router and these addresses agree with those shown by the Router and the connected devices.

The ISP that I use remotely reboots the Router quite regularly, about once a week, usually over a weekend when I assume they are doing some maintenance work. The internal IP addresses have always been in the 192.xxx... range, however at the last reboot of the Router, in addition to the 192 IP addresses a new set of IP addresses appeared in the 10.xxx.... range.

As these are also internal IP addresses I was not concerned, but what I have found confusing is that the MAC addresses associated with the 10.xxx... IP addresses are different to the MAC addresses associated with the 192.xxx... IP addresses, even though they refer to the same devices connected to the same Router.

The Network Monitor is now displaying a 192.xxx... IP address with an associated MAC address and a 10.xxx... IP address associated with a different MAC address for each network device.

Is that normal...

T.

Thanks for your reply. I think that you have misunderstood the question. My apologies if I did not make it clear.

The question is not about IP addresses it is about the same hardware device showing two different MAC addresses which is not what I expected. I fully understand about IP private and public addresses. What I don't understand is how the same device can have two different MAC addresses - that was the question.

T.

No ISP would login to your router and setup a new IP range there is no reason for that and they won't login weekly. How could they login to millions of users routers? I would think it's more likely someone else is doing this as the 10 range wouldn't normally be seen so anyone using it could steal your internet. A Mac address can be changed on the adaptor settings in windows

Thank you both for your replies. It seems as if my original Post has been misunderstood, so I will try to clarify.

Firstly, I do understand IP addresses and I thought that I understood MAC addresses.

Sumaria, I believe that you have misread my Post. I did not write that my ISP logs into my Router. What I have written is that during normal maintenance at the telephone exchange, the ISP (or the Broadband maintenance staff at the telephone exchange) will occasionally remotely restart the Router. This is normal practice and can occur simply when maintenance staff switch between Broadband switches in the telephone exchange. This is not a concern.

Sumaria, IP addresses starting with 10.xxx... or 192.xxx... will be visible internally to software that is monitoring the Network. This is also not a concern. These internal IP addresses are never visible externally.

Compumind, yes I agree, what you have written has always been my understanding. But you need to read my first Post again to understand my question.

MAC Addresses. My understanding has always been that MAC addresses are specific to a network device (interface) and that these are hard-coded into the device at time of manufacture.

Question: If the above is correct then how is it possible for the same devices on the same network to show two different MAC addresses. That is what I am seeing on the Network Monitor.

T.

As stated if you goto network card settings you can change the address the router needs to know we're to send packets so would have to assign two address if a PC is on two separate subnets

Something is very screwy here.
Your LAN was previously in the 192.xxx range.
Now you're seeing 192.xxx devices AND 10.xxx devices?
That's very peculiar.
Where do you see these? Can you post a screen cap?

margrave55 said:

Something is very screwy here.
Your LAN was previously in the 192.xxx range.
Now you're seeing 192.xxx devices AND 10.xxx devices?
That's very peculiar.
Where do you see these? Can you post a screen cap?

Thank you for your reply, that is exactly what I think.

You will understand that I am reluctant to post an image of my Network on an open Forum, however I will answer questions. The question that you have asked is "Where do you see these?". I have a Network Monitor which provides information relevant to the network including IP addresses; MAC addresses and device identification by means of a user or device allocated name. Both Ethernet and WiFi devices are monitored including the Router.

This duplication of IP addresses (192.xxx and 10.xxx) and the different MAC addresses for the same device are only being shown for those devices that are connected by Ethernet. The devices that are connected by WiFi are not showing this duplication.

Today the Network Monitor is still showing the same information but the 10.xxx addresses are now being shown as "Not Active" and the expected 192.xxx addresses are being shown as "Active".

It is really the MAC addresses that concern me. The IEEE Standards Association standard clearly states, "....MAC Addresses are ‘burned’ into the Network Interface Card (NIC) and cannot be changed...." Therefore how is it possible that these could be changed....???.... even if that change was only temporary. I believe that it is possible to fool the OS into accepting a "spoofed" MAC address, but that would require some malware to be present and two different and separate malware scans of all devices connected to the system come up clean.

To prevent network clashes in a situation where two devices on the same network have the same MAC address the normal practice is to separate the two devices by means of a Router(s) as communication will then be via the Router and not directly device-to-device. This practice shows quite clearly that MAC addresses are fixed and cannot just be changed.

Or at least all of the above is what I understand the situation to be. I am more than eager to learn something different to my understanding.

T.