wrong mac address in registry

Skip to first unread message


Feb 25, 2003, 5:18:29 PM2/25/03
I have a PC running windows XP connected to a sparc running solaris
across a crossover cable. The problem is that the XP system thinks
it's mac address is - which is actually it's network
I see this value in various places -

it is reported in the MAC address field located in
All Programs\Accessories\System Tools\System
where it is recorded as 19:02:16:08:00:00

It is reported in the output of ipconfig /all where it is reported as

It is to be found in the registry against
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{Some very
long Number}\0001\NetworkAddress
where it is recorded as

At the same level in the registry there is another entry labelled
DriverDateData which has a value which looks suspisciously like a mac
address (00 80 ec 5d 5c 42 c2 01).

I have the following questions -

How did this clearly bogus value get written to the registry? I
installed a trial version of an anti-virus program from AVG - might it
have done this scandalous thing?

How do I go about finding out what the card itself says its mac
address is - is there a way to interrogate the card directly?

How do I go about getting the correct mac address registered in all
the important system databases?

all help gratefully received.

John Wunderlich

Feb 26, 2003, 12:38:21 AM2/26/03
ikebe...@yahoo.com (ikebelover) wrote in

To get your MAC address on XP:
Start --> Control Panel
Double-Click Network Connections
Right-Click Adapter (Local Area Connections?) --> Status
Click "Support" Tab
Click "Details"

Your MAC address is listed as your "physical address". This is a 6-
octet string usually burned into the network hardware card itself and
is probably the "19:02:16:08:00:00" from your example above. (Although
the vendor-code part, 19:02:16, does not appear to be registered -- are
you sure you don't have this order reversed?)

Your "IP address" (not to be confused with your "MAC address") is
probably something like In the example you cite, is likely the address of your entire subnet (your IP
address logically ANDed with your subnet mask) and will cause problems
if it is actually entered as your IP address. IP addresses can change
readily -- MAC addresses should never change for a given hardware NIC

The string that you cite as

"suspisciously like a mac address (00 80 ec 5d 5c 42 c2 01)"

probably actually is a date. Date is often specified as the number of
seconds after a reference date/time and this entity describes a 32-bit
(8-octet) integer that could be just that. MAC addresses are always 6-
octet entities.


Reply all
Reply to author
0 new messages