Solved

Why does my PC's MAC address keep changing? How can I stop it?

Posted on 2011-03-09
26
4,678 Views
Last Modified: 2012-05-11
I have a new HP 3130 MT desktop PC running Windows 7 Pro x64. Our DHCP server is a Windows 2003 domain controller. In DHCP, I have an IP address reservation for my PC. This is so I can always receive the same dynamic IP address when I boot up. This is useful since I collect firewall logs directly to my PC. Anyhow, this always worked fine until I got the new PC. Now, every once in a while I notice that I don't have my reserved IP address. When I check my PC MAC address, I notice that it changed since the last time I posted it into my DHCP reservation. This causes me to not receive my reserved IP address and I need to update the MAC address again. Why does it keep changing automatically, and how can I make my PC keep the same MAC address?
0
Comment
Question by:robw24
  • 10
  • 7
  • 3
  • +3
26 Comments
 
LVL 10

Expert Comment

by:Martin_J_Parker
ID: 35083192
The MAC address shouldn't keep changing.  It is possible that you might have some software installed which gives you a temporary MAC address.  Do you have any Virtual Private Network (VPN) or gateway access software installed? If so that will probably be the culprit and it will depend on the manufacturer as to whether or not it is configurable.

The only other thing that comes to mind is are you running in a virtual machine which configures the network on the fly on startup?
0
 
LVL 5

Expert Comment

by:sweeps
ID: 35083196
The only way to get different MAC address's would be if you have more than one Nic card.  The cards have a hard set MAC address that identifies manufacturer and other information about the card.  These cannot change unless you have a piece of software that can spoof a MAC address or change the EPROM stored MAC address.  
0
 
LVL 10

Expert Comment

by:Martin_J_Parker
ID: 35083262
Yes, the card comes with a hardware MAC, but it is very easy to change what is seen by Windows on most cards.  There are at least 2 methods which will work in Windows 7:

1. Control Panel->device Manage->Network Adapter->Adv.->Network Address, put some values in the text box

2. Change the register key value, like link here: http://www.windowsreference.com/networking/how-to-change-mac-address-in-windows-registry/

Software can do the latter with no problems.  In addition a VPN will often set up a pseudo-device connection which has its own MAC address.
0
 
LVL 1

Author Comment

by:robw24
ID: 35083343
To the best of my knowledge I don't have any software that would change the MAC address. I am not working in any virtual environment or VPN nor do I have any gateway access software installed. I have not changed my NIC card.

I just went into the network connection details in Windows and it says I have a Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC, and the Physical Address is 6C-62-6D-63-D2-AB.

I will check in back here the next time I don't have the reserved IP address and report what the Physical Address reports as. This may be  a day or two or three.
0
 
LVL 1

Author Comment

by:robw24
ID: 35083383
Martin, I just checked "Network Address" as you mentioned and it is set to "Not Present" and the value field box is empty. I assume this is the default and normal. If the address has been changed I would expect to see something in the text box but there is not.
0
 
LVL 5

Expert Comment

by:sweeps
ID: 35083422
the mac address begining with 6C:62:6D is manufactured by # Micro-Star INT'L CO., LTD
0
 
LVL 1

Author Comment

by:robw24
ID: 35083450
Perhaps Micro-Star manufactures Realtek NIC's?
0
 
LVL 10

Accepted Solution

by:
Martin_J_Parker earned 400 total points
ID: 35083490
What happens if you explicitly set the 6C-62-6D-63-D2-AB address in the Network Address box?
That might force it to stop changing every time you restart.

It doesn't much matter what the MAC address is as long as you don't have another of the same address on the network, so explicitly setting it to a known working one may solve the problem.
0
 
LVL 1

Author Comment

by:robw24
ID: 35107995
Martin, thanks I will try that as a last resort. The last two days my MAC has not changed. Lets see what I have on Monday after being off for the weekend.
0
 
LVL 16

Expert Comment

by:vivigatt
ID: 35109184
When it changes address does it take?
Is it a dual port NIC (with dual Ethernet sockets)?
Do you have a WiFi adapter in the PC as well?
Is there a Bridged network adapter (software adapter) in your PC's network configuration? Or did you create one recently?

Something worth considering: Update the drivers for your NIC:
http://218.210.127.131/downloads/downloadsView.aspx?Langid=1&PNid=5&PFid=5&Level=5&Conn=4&DownTypeID=3&GetDown=false#RTL8111B/RTL8168B/RTL8111/RTL8168%3Cbr%3ERTL8111C/RTL8111CP/RTL8111D%28L%29%3Cbr%3ERTL8168C/RTL8111DP

Newer than what HP will provide you, and it will work all the same (HP will provide the same drivers 2 years from now !)


Now changing a MAC address unwillingly s very suspect. MAC address spoofing does exist but it is tricky. If that was what happened to you, I would suspect some malware; virus or anything nasty like that.
0
 
LVL 1

Author Comment

by:robw24
ID: 35109861
I don't undertand your first question, please clarify. It is not a dual port nic, there is only one socket. It is a built-in socket on a standard HP 3130 desktop PC. There is no WIFI adapter. There is no bridge...
I will try the updated NIC driver if the MAC changes again. As far as malware, I suppose it is always possible but this is a pretty new install and I would normally know if I had something going on that shouldn't be. I have ran scans and rootkit checks and nothing has shown up.
0
 
LVL 16

Expert Comment

by:vivigatt
ID: 35110981
My first question was:

If the MAC address changed, (again) what MAC address did it take?
IPConfig /all should tell (but Wireshark traces might even be more reliable)
0
 
LVL 1

Author Comment

by:robw24
ID: 35111077
I had not really paid attention except for the last time it changed. That time, I think only the second to last letter changed and the rest was the same. Next time it changes I will post the new address.
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 16

Assisted Solution

by:vivigatt
vivigatt earned 100 total points
ID: 35111172
If this is the case, I would suspect a stability in the NIC or the quartz (is there still a quartz in Ethernet chips?) and this would be a good reason to use the warranty...
0
 
LVL 5

Expert Comment

by:nomorefuzzylogic
ID: 35127302
I assume that you don't have a 2nd DHCP server running on the network - for example an Internet router with DHCP Server enabled?
Do "ipconfig /all" when you get the wrong IP address and check the DHCP server listed - if this is the Win2003 server then I would be surprised!
0
 
LVL 1

Author Comment

by:robw24
ID: 35127508
I only have a primary and secondary DHCP server, no others. The reservation is setup the same on both. The only reason I get the wrong IP address occasionally is because the MAC address stops matching what is configured in the reservation and thus the PC receives a regular issue, non-reserved IP address that is available in the range.

Well I just checked this morning and the MAC has not changed since I opened the ticket (go figure) and I have the reserved IP address.

I don't have much choice but to leave the question opened for a while, perhaps up to a couple more weeks, until the MAC changes again. If it does not, then I suppose it fixed itself but I will award points based on some great pointers I have received.
0
 
LVL 10

Expert Comment

by:dfke
ID: 35127758
Each MAC adress is unique. Remove the reservation from DHCP, create a new one with your current MAC. Reboot.
0
 
LVL 16

Expert Comment

by:vivigatt
ID: 35127873
If you want to stress test your computer, create a script that will reboot it in loop and check the IP address each time
You can use my NICINdex utility:
http://filedb.experts-exchange.com/incoming/2010/04_w18/300050/NICIndex.zip
to store the IP address of a particular NIC in some environment variable and then compare this IP address with the one that is expected, and log something when/ it changed
More details about NICINdex in this article:
http://www.experts-exchange.com/Software/System_Utilities/Remote_Access/VPN/A_2977-VPN-use-default-gateway-AND-access-your-local-network.html
0
 
LVL 5

Expert Comment

by:nomorefuzzylogic
ID: 35128137
0
 
LVL 1

Author Comment

by:robw24
ID: 35214552
Ok, here we go... I noticed my IP address was different today, meaning my MAC address must have changed and I did not receive the reserved IP address. Sure enough, I ran ipconfig /all as well as a LanSpy scan and the MAC address is now 36:62:6D:63:D2:AB

If you read my earlier posts, my MAC address was 6C:62:6D:63:D2:AB

Looks like this time, just the first set of values changed.
0
 
LVL 5

Expert Comment

by:nomorefuzzylogic
ID: 35214996
I would guess that it is the ROM on the NIC or, possibly, a timing issue on the bus. You are running default timing in BIOS and not trying any overclocking? It is only the 1st byte that is changing.
My choice would be to add a new NIC and disable / remove the one you are using now. If there is a timing issue it corrupt data too so don't risk it.
0
 
LVL 16

Expert Comment

by:vivigatt
ID: 35215076
If the computer is new enough, you can sent to to repair... I guess that this is a reason that is "bad enough" for the warranty to be applied
0
 
LVL 1

Author Comment

by:robw24
ID: 35215961
I am not overclocking... I guess I will try to just put my old MAC in manually and see if it sticks.
0
 
LVL 16

Expert Comment

by:vivigatt
ID: 35218967
Can you force the MAC at the BIOS level? This may be the best option.
0
 
LVL 1

Author Comment

by:robw24
ID: 35232727
I don't think this bios has the ability to set the MAC address, I don't recall ever seeing that. Well it looks like just adding the desired MAC address into the Network Address field of the Advanced properties of the adapter is a great, simple workaround. I'm gonna go with that. Thanks everyone.
0
 
LVL 16

Expert Comment

by:vivigatt
ID: 35232782
Some BIOSes in the past had this capability, but I don't think that HP's BIOS have it.
However, I would be very cautious using a computer which MAC address seems to be "unstable", since it may be just a symptom of something "more serious".
If you can, you could save your current configuration (ghost or something similar) and use another computer (maybe the same one you have after it came from repair or they changed the mother board) with the same configuration.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

This article is in response to a question (http://www.experts-exchange.com/Networking/Network_Management/Network_Analysis/Q_28230497.html) here at Experts Exchange. The Original Poster (OP) requires a utility that will accept a list of IP addresses …
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now