RE: Blocked IP address - What is MAC 24:5e:0d:1c:06:b7 ?



The MAC address of the TS is 00-14-5e-7b-0d-54, however what comes back is
24:5e:0d:1c:06:b7 !?

Can you elaborate some more about the DHCP question ?

Yes, we do have DHCP enabled on the network.

TIA,

Mike

"Ian Zahn" wrote:


Not sure why your get a different Mac address but on the terminal server you
could try ipconfig -all from the command prompt. The part that says "Physical
Address" is the MAC address so if it is your terminal server you know it is
something to do with it.

Also depends how your DHCP is setup, do you have DHCP on your network?

"MJ" wrote:

After running Windows Server 2003 Server Configuration wizard to add Terminal
Services role, suddenly I could not ping my local gateway (and everything
beyond).
The server (10.70.98.202) retained network connectivity on the local subnet
only.

It seems that the server IP address (10.70.98.202) became "blocked" by the
the gateway or ?

So, I fired up the ETHEREAL tool:

After a quick analysis of the PING REPLY packet (go into detailes), I
noticed that the DST MAC address was changed/replaced:

Instead of 00-14-5e-7b-0d-54 (10.70.98.202) as it can be seen from the PING
REQUEST packet, in the PING REPLY packet this MAC was replaced to
24:5e:0d:1c:06:b7 !?

I did the same experiment on another segment (using another "blocked IP"
address 10.70.65.133 and pinging its gateway 10.70.71.250) on my workstation
and surely enough the PING REPLY again replaced the original MAC address with
the SAME 24:5e:0d:1c:06:b7 !?

In short (as verified on two different segments), the PING REPLY packet
contains a 'WRONG' MAC address.

In other words, the gateway in its replies substitutes the original MAC
address with the 24:5e:0d:1c:06:b7.

What is the 24:5e:0d:1c:06:b7 MAC address ?

One possible explanation could be that when the Terminal Services start up
(or when the Configuration wizard runs), it broadcasts looking for the MS
Terminal Services License Server. This could be interpreted by something on a
network as a brodcast storm and perhaps it quarantines my server ?
Just a theory.

What is going on ?
.