IP and MAC change randomly

[sdutremble]

Not sure if this a bug but on many of my Servers, I have two NICs. One is 1Gbps (LowSpeed in the 192.168.0.0/24) and one that is 2.5Gbps (HighSpeed in the 10.10.0.0/24). All are static IPs.
They both have a different MAC and associated vendor.
I have seen on many of my servers where the HighSpeed IP is associated with the LowSpeed MAC and is seen as a new device.
I normally name my devices as Dev1 (HighSpeed) only for the 2.5Gbps MAC.
The MACs do not change and all such devices are assigned static IPs.
Has anyone noticed this before?

[jokob-sk]

Hi,

The behavior might be relate to random MAC address behavior: https://jokob-sk.github.io/NetAlertX/RANDOM_MAC/?h=random

NAX uses the MAC as the primary id so if it changes a new device is detected.

[sdutremble]

This is my issue: The two NICs have their own mac and they did not change. NAX is detecting a new device with the high speed IP but with the low speed mac.
For example:
Low Speed NIC at 192.168.0.16 has MAC 7c:57:58:5f:aa:a5
High speed NIC at 10.10.0.16: MAC is c0:ea:c3:60:47:a0.
At the moment, NAX detected both of them with the High Speed IP and the status is DOWN. The low speed entry disappeared.
Both IPs are online on the network.

[jokob-sk]

might be related to #724 and #1038

I can't do much if the underlying tool (arpscan) returns incorrect results.

a mitigation could be to use other scanners in conjunction with arpscan, e.g. nmapdev. Check plugins docs to find and experiment w/ appropriate candidates: https://jokob-sk.github.io/NetAlertX/PLUGINS/?h=plugins#quick-start