3
\$\begingroup\$

So I'm working on a product which will have two Ethernet ports:
One for "public" network, which will be used by the customer, and one internal, within the machine chassis, which needs to be opened, which should be only used by the service technician and internal accessories.

The dogma to which I was exposed to during my network training says that all Ethernet ports should use registered OUI numbers, but on the other hand, I'm can't really think of a reason why would we need an official MAC address in this case.

So my question is:
Is there any reason why to use the officially registered OUI numbers for the internal Ethernet port?

\$\endgroup\$
12
  • 1
    \$\begingroup\$ As a sidenote: Not using the official OUI would save manufacturing costs, since we could skip the MAC programming step for one of the ports. The other one comes preconfigured with its own unique address from the manufacturer. \$\endgroup\$
    – AndrejaKo
    Jun 6, 2018 at 9:08
  • \$\begingroup\$ Can you guarantee that you have no collision with whatever equipment the service technician will ever connect there? \$\endgroup\$
    – PlasmaHH
    Jun 6, 2018 at 9:30
  • 6
    \$\begingroup\$ Use an official number for the internal port, but make it the same on all products so you only need one number? \$\endgroup\$
    – Finbarr
    Jun 6, 2018 at 9:41
  • 1
    \$\begingroup\$ stupid question (I'm really not versed at all in the regulation surrounding this): Isn't this the exact use case for Locally administerd Addresses, i.e. you just set the right bit in the MAC address for "hey, this is a locally administrated address", and then just pick random unique ones? \$\endgroup\$ Jun 6, 2018 at 11:43
  • 2
    \$\begingroup\$ @AndrejaKo I don't know your device well enough to advise, but if the ethernet interface is controlled by software which is somehow aware of the serial number of the device, you'd have nothing to manage – each devices MAC address would be private prefix + serial number. That's how I'd roll all this. \$\endgroup\$ Jun 6, 2018 at 12:31

1 Answer 1

1
\$\begingroup\$

As Marcus suggested, this is where the locally administered MAC addresses come handy. Here is the structure of a MAC address (taken from Wikipedia):

enter image description here

So, set b0 of the first byte to 0 (unicast) and b1 of the first byte to 1, and then you're free to set the other bits as you wish.

However, this requires that you can ensure the following thing: this port should never be connected to a network where there might potentially be other nodes with locally administered MAC addresses.

But equipments with locally administered MAC addresses are not supposed to be found on the market. If the only equipment that can potentially be connected to this port is a regular laptop, or even a whole newtork containing only regular switches/routers and computers, there is no such risk.

Now, there are two strategies: either you decide on a single MAC address and assign it to all your devices (they will all have the same address), or you define a scheme with a fixed and a variable part (the variable part can be taken from the serial number of the device if there is one available somewhere), so that each device has a unique (locally administered) MAC.

The single MAC address scheme is only possible is you can ensure that:

  1. There will never be two such devices on the same subnet at the same time. This is easy to guarantee if the service laptop is always directly connected to the device (not through a network with potentially multiple nodes).
  2. You don't disconnect one of your devices from the network and plug another one before the ARP cache of the service laptop (or any other equipment that needs to talk to your device) has expired. On typical linux/windows computers, the ARP cache expires after a few minutes. On other equipments, it can be much longer.

Regarding your concern of potential MAC address filters set by the IT: this isn't likely. MAC address filters are typically set on a network equipment (wifi access point, network switch, ...), and are set so that only registered nodes can connect to the network. If this is the case, you'll have a problem anyway, because your device won't be registered whether it has a regular OUI-assigned address or a locally administered one. I have never seen a MAC address filter set on a computer station, even in totally paranoiac IT environments.

As a conclusion, I think having a locally administered address in this case likely won't lead to a problem. However, problems are more likely to arise if you assign the same address to all your devices. I'd rather use unique addresses per device if it is achievable.

\$\endgroup\$
4
  • \$\begingroup\$ Would ARP cache issue be handled if all devices have the same IP address? \$\endgroup\$
    – AndrejaKo
    Jun 6, 2018 at 13:24
  • \$\begingroup\$ @AndrejaKo It is hard to predict what would happen, actually. Indeed, it seems it could solve the problem, but maybe the OS stores more information in the ARP cache than just MAC <-> IP. There could be state information, etc... In which case, if the peer node changes without the laptop noticing, everything could fall down. I wouldn't take that risk. \$\endgroup\$
    – dim
    Jun 6, 2018 at 13:29
  • \$\begingroup\$ What you could do is generate a random address, eventually, when the device starts up. Safer than a single addresse, and maybe easier to achieve than unique addresses per devices. \$\endgroup\$
    – dim
    Jun 6, 2018 at 13:32
  • \$\begingroup\$ Yeah, perhaps the MAC+Serial number+ maybe something else option which was already mentioned in comments would help there, just to be sure. \$\endgroup\$
    – AndrejaKo
    Jun 6, 2018 at 13:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.