A colleague of mine has run across what appear to be 56-bit MAC addresses in an ISP DHCP log. I know there are IEEE specifications for 48 and 64 bit addresses (MAC-46, EUI-48, EUI-64), but I can't find anything about 56 bit addresses.
The "offending" MAC is the same as the client's cable modem MAC, except it is prefixed by "01". (The cable modem MAC is also found in the log entry - this second MAC appears as a separate entry, just after the cable modem MAC.)
My colleague has asked the ISP for clarification on the log file format, but he's still waiting for a response.
The DHCP entries look something like this Date & time, lease expiry date & time, publicly assigned IP, cable modem IP, 46-bit cable modem mac, 56-bit mac, description, DHCP, other fields….
Google has been of no help… Any suggestions/ideas? Has anyone else come across this?
The intro to this doc talks about combining MAC addresses of host & router to create a 56bit mac address using "IP Marking Algorithm" for tracing packets. Extract reads
"In current marking algorithm, router data is sent to identification field of packet's …. Input 48 bit MAC address, Output 56 bit MAC-slice combination. …"
http//
Please share anything further you find on this.
MindSmith's suggestion sounds interesting …
Any further information about the system that the logs have come from ? Is this a Linux DHCPd for example, or Windows, or something else ?
This is an integrity check algorithm using 56-bit slice combination.
The input for this check algo is 56-bits, with 48-bits as the output.
Pages 442-443 of
First International Computer Science Symposium in Russia, CSR 2006, St. Petersburg, Russia, June 8-12, 2006 proceedings.
The
Are you sure it's a MAC address? Just because it's written in hex does not make it a MAC address. Could it be a portion of a IP6 address?