Subscriber Discussion

OVRC Network Scan Tool Showing Dahua Cameras As Ubiquiti Devices And Duplicating The MAC Address

JH
Jay Hobdy
Sep 11, 2018
IPVMU Certified

Not sure if this is a new occurrence or has always happened and we just noticed. We are trying to use OVRC which is a simple network scanning device that scans the network and lets us know of offline devices. It is skipping multiple items due to duplicate MAC's.

 

Anything over .100 is a Dahua, or possibly a Uniview camera, but not Ubiquiti. Radios start at .51.

 

101 - 105 or 106, are probably hardwired to the headend, the rest of the cameras are on a wireless link.

 

Avatar
John Scanlan
Sep 11, 2018
IPVM • IPVMU Certified

Jay - Have you cleared the scan history?

They are caching previous scans so that the scanner can provide a comparison to what was previously on the network; i.e. this device is now down/dead.

It does seem to keep and confuse some of the cached information with current scan information though.  "Clear Scan History" should help here.

That is a screen shot from advanced IP scanner, correct?

(1)
(1)
JH
Jay Hobdy
Sep 11, 2018
IPVMU Certified

Not sure what my tech did, he may chime in later.

 

But that scan I posted did not come from OVRC. That was from another utility like Angry IP scanner or similar. So OVRC and the utility are seeing the same thing. OVRC rejects duplicate MAC's so it is not showing several devices.

 

We are out of my league here but its hard to piece together how IP 1 with a MAC of A, could get confused with IP2 with a MAC of B.The same IP will always have the same MAC.

 

FYI this is an older install we inherited. They are running Nano Stations, maybe Loco's.

 

 

Avatar
John Scanlan
Sep 11, 2018
IPVM • IPVMU Certified

I would have your tech clear the cache on Advanced IP Scanner, then scan again:

This will help you get an accurate look at the network.

You may want to do the same with OVRC if they have left that option in. The problem is that in doing this you are erasing that historical data of what was on the network previously. If you are OK with starting fresh here and the network is not dynamic / in flux, then that should work for you.

MJ
Matt Joslin
Sep 11, 2018

 Yes this is a screenshot from advanced IP scanner. I did not blow the cache out as I normally use angry IP scanner, support pulled that down to make sure it wasn’t a software issue  That scan was the maiden scan by advanced IP scanner.

The odd thing here is on the OVRC device when we add the IP manually it’s sees it takes it but then on the next scan of devices drops it out I can’t help but relate this to the Mac address issue.  Clearing the cache and performing another scan will help in determining this was just bad data taking me down the wrong path. I went through a million steps today but I believe once added back to the OVRC device the same Mac showed up under the IP in devices. 

(1)
Avatar
John Scanlan
Sep 11, 2018
IPVM • IPVMU Certified

Matt - thanks for your first comment.  Did support have you check for a network loop or clear the arp tables on the switches and/or machines involved?

MJ
Matt Joslin
Sep 11, 2018

 I checked for a network loop myself prior to moving on to the issue that led me to finding the duplicate Macs. I did find that three devices were plugged directly into the Comcast modem I reduced it down to one. I did not manually clear the arp tables but it was my understanding that on power cycle most of these devices they will clear out that information and rebuild it, is that the case?

MJ
Matt Joslin
Sep 11, 2018

 In the first image is the camera ending in 107 which the device OVRC finds and realizes it’s online but as you can see in the next image when I add 108 in manually and it verifies that it’s online it kicks out 107 and you can see they share the same MAC address. I hope this provide some further clarity for those helping out. All the help is much appreciated

 

Avatar
Brian Karas
Sep 11, 2018
Pelican Zero

Are the Ubiquiti devices setup as some form of bridges? Just guessing, but my hunch is the ...D8 MAC is the local-to-the-scanning-PC side of PtP/PtMP bridge. 

(1)
MD
Matthew Del Salto
Sep 14, 2018
Hudson Security

I have noticed this with Ubiquiti in bridge mode. I believe it is because it is essentially acting as a router and passing the traffic of the camera and the rest of the network to and fro.

(1)
Avatar
Brian Karas
Sep 14, 2018
Pelican Zero

Yes, they often act as a brouter. Causes problems like odd ARP tables where the MAC associated with an IP is misleading. The PC and far-end host are on the same LAN subnet, but are segmented from the perspective of collision/broadcast domains. In this scenario the PC can't put a packet on the wire that is going to be picked up by the far-end host without the intermediate brouter device making some gating decisions.

If you have a layer 2 discovery tool for these devices it would be interesting to clear your ARP table, do a device discovery, and then see what MAC address is associated with that IP after the discovery. The Ubiquiti device should pass layer 2 broadcast packets back and forth unmolested.

 

(1)
UI
Undisclosed Integrator #1
Sep 16, 2018

I had the same "problem" a few years back. I think I solved it to turn on or of the WDS Transparent bridge mode?

(1)
New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions