MAC address 00:50:56:50:00:00 — Beacon Probing

We had an unusual network issue the other day and as part of it we were told that two devices were reporting the same MAC address – 00:50:56:50:00:00. The address manufacturer is VMware, which suggested it was a VM or VMKernel interface.

I searched through the entire VC and was unable to find the MAC anywhere. I looked at the MAC/CAM tables of our switches and was able to confirm it existed (0050.5650.0000), but couldn’t track down the owner. Because the address looked so unusual, I even Googled it and failed to find anything.

In order to isolate the address, I decided to change our active/passive load balancing on some of our hosts to use the passive link. This way, if the MAC address stopped showing on switchA and started showing on switchB, I could identify the culprit.

As I was moving some of the vnics, I realized that some of our vSwitches were set to use Beacon Probing. Since our standard config is to use Link State, I change the setting and then reviewed our switches. The mystery MAC address immediately disappeared. I re-enabled Beacon Probing to be sure, and watched the MAC reappear, disabled and it disappears.