0

I have a computer used for backups that does a wake-on-lan to run backups and then turns off. This morning something happened that caused the MAC address to change. While I know the MAC address can be changed, I didn't think this could happen without asking.

This computer has been running Ubuntu and getting updated since 16.04. It is currently on Ubuntu 20.04.3 LTS. At some point eth0 became enp2s0 but I can't imagine why that would have changed the MAC. The Ethernet port is build into the motherboard. The computer only runs for 20-60 minutes a day and does nothing else. It hasn't moved or had hardware modifications in years. It has been a solid backup system--monitored but otherwise ignored because it just works--the kind of reliability I've come to expect from a Ubuntu machine.

Any ideas on what might have caused this? Could some update have caused this? A hardware issue? If so, how would I find out?

EDIT: The original MAC address was 00:1a:4d:5e:7e:85 and the new address is aa:4c:ca:15:7e:97. The two are not even close to one another and hard to explain by a bit flip in EEPROM. The original address shows Giga-Byte Tech as the vendor (as expected, it is a Giga-Byte motherboard). The new address has no vendor and looks to be completely random.

EDIT: As requested, the output of several commands.

$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether aa:4c:ca:15:7e:97 brd ff:ff:ff:ff:ff:ff
    inet 10.4.8.210/16 brd 10.4.255.255 scope global noprefixroute enp2s0
       valid_lft forever preferred_lft forever
    inet6 fe80::82a3:395:882b:844a/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
$ ls -l /etc/netplan/
total 0
$ sudo cat /etc/netplan/*
cat: &apos;/etc/netplan/*&apos;: No such file or directory
$ sudo ls -l /etc/NetworkManager/system-connections/
total 0
$ sudo cat /etc/NetworkManager/system-connections/*
cat: &apos;/etc/NetworkManager/system-connections/*&apos;: No such file or directory
$ sudo grep -lR "aa:4c:ca:15:7e:97" /etc 2>/dev/null

$ sudo grep -R -C 4 "aa:4c:ca:15:7e:97" /etc  2>/dev/null

$

In addition, I booted the system using SystemRescue.

[root@sysrescue ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether aa:4c:ca:15:7e:97 brd ff:ff:ff:ff:ff:ff
    inet 10.4.8.210/16 brd 10.4.255.255 scope global noprefixroute enp2s0
       valid_lft forever preferred_lft forever
    inet6 fe80::fd62:c737:4f9c:80fe/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

Clearly, the hardware MAC has changed and it isn't Ubuntu setting this address each time the system boots. How and why the hardware MAC changed is still a mystery.

2022-02-28

After physically removing the power cord from the computer, the MAC address returned to the original. While I had power cycled the computer several times, I had not removed the power cord. The NIC must get power even when the rest of the machine is powered down in order to allow the wake-on-LAN functionality. Whatever caused this problem did so in a temporary way.

2023-06-24

The motherboard of this computer, a GIGABYTE GA-MA790FX-DS5, was replaced after having problems with periodic failures of SATA drives. I think the chipset was dying and this random change of the MAC address was the first symptom. MAC change was observed one more time and again reset after power was fully removed. Computer was 14-years-old, having run 24/7 the first 3 years of life, and then for less than an hour a day the remaining time. It was always powered for Wake-On-LAN.

In my case I am going to credit the random MAC change to a hardware failure and feel pretty confident this was the case.

6
  • Does anyone else other than you have access to your machine?
    – Logan
    Feb 18, 2022 at 18:11
  • This might help: linuxfordevices.com/tutorials/ubuntu/spoof-mac-address It talks about how to change or spoof MAC address, but it may provide some insight... This may also help: ubuntuforums.org/showthread.php?t=2451515
    – Logan
    Feb 18, 2022 at 18:11
  • @Jeff No one else has access to that machine--just the backup user and admin user. Physically there is access to the machine, but judging from the dust, it hasn't been touched in a long time.
    – A. Que
    Feb 18, 2022 at 18:40
  • The medium (typically flash memory) storing the MAC address isn't perfect. Bit flips and even complete loss do happen. If you'd share the old and new MAC address by adding it to your question we might have a look to see whether there's an explainable pattern in the change.
    – Tilman
    Feb 19, 2022 at 0:26
  • @Tilman I have added the MAC address as requested. I would agree that bit flips and loss happen, but in that case I would expect a similar MAC or all FF or 00.
    – A. Que
    Feb 19, 2022 at 1:45

1 Answer 1

0

Please, add the output of these commands (in separated parts) to your question above:

ip addr
ls -l /etc/netplan/
sudo cat /etc/netplan/*
sudo ls -l /etc/NetworkManager/system-connections/
sudo cat /etc/NetworkManager/system-connections/*
sudo grep -lR "aa:4c:ca:15:7e:97" /etc 2>/dev/null
sudo grep -R -C 4 "aa:4c:ca:15:7e:97" /etc  2>/dev/null

There is an easy way to separate the system setup problem from the hardware problem. Boot your computer using a USB FLASH disk with live Linux image and check the MAC address of the Ethernet interface. If the MAC remains aa:4c:ca:15:7e:97, then it is probably a HW issue. If the MAC switches back to 00:1a:4d:5e:7e:85, then a bad MAC is set somewhere in your installed Ubuntu system.

1
  • I had added the requested information. Booting with a live disk shows the new MAC address, so it has clearly been set. How and why is still unknown. Not enough reputation in this forum to up-vote your answer, but thanks all the same.
    – A. Que
    Feb 19, 2022 at 23:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .