Different MAC router when scanning with nmap
 

Hi,
I'm doing some testing on my network and having the following outcome for
sudo nmap -sV -vv -PN 192.168.1.1:

PORT STATE SERVICE VERSION
80/tcp open http Linksys WAG200GB WAP http config
443/tcp open tcpwrapped
1863/tcp open tcpwrapped
1864/tcp open tcpwrapped
4443/tcp open tcpwrapped
5190/tcp open tcpwrapped
5566/tcp open tcpwrapped
49152/tcp open http Intel UPnP reference SDK httpd 1.2 (UPnP 1.0, platform Linux 2.4.17_mvl21-malta-mips_fp_le)
MAC Address: xx:xx:xx:xx:80:32 (Cisco-Linksys)
Service Info: OS: Linux; Device: WAP


When I check the status in my Linksys router (thru web-interface), I see the following:

MAC Address: xx:xx:xx:xx:80:33 For gateway

Tought the mac was a "unique identifier" for the router.
Is it correct that th're two MAC's, One for local one for gateway? Or is it spoofed?

Thanks in advance!

Hi,

different network devices will have different mac addresses. Presumably you are looking at one of the internal interfaces when you run nmap, and are looking at the external interface when you use the web interface.

Evo2.

Yes, there are two MACs. But one is only in reference to the unique MAC. You can usually change the nonunique one to anything you want.

Thanks, Seniors!!

Wez