# MAC address in Firewall log

**URL:** <https://community.ipfire.org/t/mac-address-in-firewall-log/7518>\
**Category:** Network\
**Created:** [21 March 2022 03:09 UTC](https://community.ipfire.org/t/mac-address-in-firewall-log/7518 "2022-03-21T03:09:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![trish](https://community.ipfire.org/user_avatar/community.ipfire.org/trish/32/16001_2.png) [@trish](https://community.ipfire.org/u/trish)\
**Post date:** [21 March 2022 03:09 UTC](https://community.ipfire.org/t/mac-address-in-firewall-log/7518/1 "2022-03-21T03:09:20Z")

</div>

What MAC Address is displayed in the firewall log?  
when I go to:  
WUI-Logs-Firewall Logs

I see some weird source IP’s from CN, BR, CL, KE and the MAC address is the same.  
I can’t figure out whose MAC address is that

> **[Firewall Logs - The IPFire Wiki](https://wiki.ipfire.org/configuration/logs/firewall)**

[Firewall Log](https://wiki.ipfire.org/configuration/logs/firewall_logs_log.png?s=920)

---

<div class="post-metadata">

**Author:** ![bonnietwin](https://community.ipfire.org/user_avatar/community.ipfire.org/bonnietwin/32/12350_2.png) [@bonnietwin](https://community.ipfire.org/u/bonnietwin)\
**Post date:** [21 March 2022 08:48 UTC](https://community.ipfire.org/t/mac-address-in-firewall-log/7518/2 "2022-03-21T08:48:29Z")

</div>

That is the MAC address of the interface on your ISP’s Gateway system.

You can find it listed in the WUI menu Status - Network (others) in the ARP Table Entries at the bottom of that page.

Your ISP’s Gateway IP is listed on the System - Home page.

---

<div class="post-metadata">

**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\
**Post date:** [22 March 2022 09:02 UTC](https://community.ipfire.org/t/mac-address-in-firewall-log/7518/3 "2022-03-22T09:02:52Z")

</div>

Hi,

for the sake of completeness: MAC addresses are a local thing, and are not visible to other non-local networks. Therefore, any MAC address appearing in conjunction with a public IP address that does not belong to a local network most likely belongs to a local gateway, modem, or similar networking equipment.

For a quick analysis on the vendor the MAC address range is assigned to, [this](https://www.wireshark.org/tools/oui-lookup.html) tool might be helpful.

Thanks, and best regards,  
Peter Müller

---

<div class="post-metadata">

**Author:** ![kenzo\_ume](https://community.ipfire.org/user_avatar/community.ipfire.org/kenzo_ume/32/16625_2.png) [@kenzo\_ume](https://community.ipfire.org/u/kenzo_ume)\
**Post date:** [31 March 2022 05:11 UTC](https://community.ipfire.org/t/mac-address-in-firewall-log/7518/4 "2022-03-31T05:11:19Z")

</div>

Hi  
This is another search tool that might be useful

> **[MAC Address Vendor Lookup | MAC Address Lookup](https://maclookup.app/)**
>
> Fast and easy MAC address lookups. Search vendor, manufacturer or organization of a device by MAC/OUI address. Features include search and API access

James