If a hotspot is on I think it pretends to be every MAC address. I don't
think it would invent new ones. You'd see MAC addresses from the same
physical layer2 network showing up in the bridge table on the ePMP
because the tik behind the ePMP is responding using all of them.
So if those extra MAC addresses are real Mikrotiks elsewhere on the
Network, then a hotspot or something like a hotspot might explain it.
If it's not the Mikrotik hotspot then maybe some kind of porn filter
device. Putting the ePMP in NAT mode should mitigate that. Or enable
the MAC security feature and limit it to 1 or 2 MAC addresses.
.....that said, I haven't used the Hotspot feature since 2012 or so. I
might not be remembering right. I seem to remember reading about a
content filter that did something similar, but maybe I made that up too.
-Adam
On 3/9/2021 7:39 PM, Josh Luthman wrote:
Disable the package. Just in case there's a bug...
Josh Luthman
24/7 Help Desk: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373
On Tue, Mar 9, 2021 at 3:43 PM Larry Smith <[email protected]
<mailto:[email protected]>> wrote:
Thought so too, no hotspot, no proxy arp on any interface.
--
Larry Smith
[email protected] <mailto:[email protected]>
On Tue March 9 2021 14:07, Josh Luthman wrote:
> Really sounds like the hotspot package.
>
> Maybe proxy arp.
>
> Josh Luthman
> 24/7 Help Desk: 937-552-2340
> Direct: 937-552-2343
> 1100 Wayne St
> Suite 1337
> Troy, OH 45373
>
> On Tue, Mar 9, 2021 at 3:01 PM Larry Smith <[email protected]
<mailto:[email protected]>> wrote:
> > Ok, have a strange situation that has repeated itself
> > and I can come up with no answer. Customer behind
> > an ePMP 1000, mikrotik HAP 52. Suddenly last night
> > the ePMP radio went from 1 LAN MAC (the tik) to 43
> > (forthy-three) MACs, most of them a variation of the
> > actual MAC of the TIK. At this time the TIK started
> > grabbing (using) a swath of different IP, all part of
> > our network (both public and private) but some of
> > them not part of our wireless network.
> > (EG the 100, 101, 102.X nets are part of our wireless
> > but the 118.x network is not)
> >
> > Suspend ethernet on radio, wait 5, unsuspend and
> > login to TIK, reboot, reboot radio. all normal again.
> > (cannot get into tik without doing this).
> >
> > This happended to the same customer, on different
> > private (radio) and public (tik) IP address in April 2020
> > at which time the radio had 94 MAC address on the LAN
> > interface. At that time we installed a new ePMP and went
> > from a 952 tik to the HAP 52 thinking one of them was the
> > issue.
> >
> > Thoughts ? Suggestions we can look at ?
> >
> > PS: this customer is computer illerate and generally does
> > exactly what the tech says to do and there is no other
> > internet service at this location.
> >
> > --
> > Larry Smith
> > [email protected] <mailto:[email protected]>
> >
> > --
> > AF mailing list
> > [email protected] <mailto:[email protected]>
> > http://af.afmug.com/mailman/listinfo/af_af.afmug.com
<http://af.afmug.com/mailman/listinfo/af_af.afmug.com>
--
AF mailing list
[email protected] <mailto:[email protected]>
http://af.afmug.com/mailman/listinfo/af_af.afmug.com
<http://af.afmug.com/mailman/listinfo/af_af.afmug.com>
--
AF mailing list
[email protected]
http://af.afmug.com/mailman/listinfo/af_af.afmug.com
