Generate distinct fake MAC addresses

[jokob-sk]

Is there an existing issue for this?

• I have searched the existing open and closed issues

Is your feature request related to a problem? Please describe

Can't easily recognize fake MACs generated by plugins, and a unique mac is necessary for every device

Once implemented can be used to identify FAKE MACs and overwrite them with real ones once detected.

❓ do we updated related records (historical entries, events etc?) relying on MAC -> probably not

Describe the solution you'd like

Maybe F-<MAC> or ip-<IP>

Describe alternatives you've considered

optional new device field

Anything else?

This will then help skipping fake mac addresses on certain scanners

Am I willing to test this? 🧪

• I will do my best to test this feature on the netlertx-dev image when requested within 48h and report bugs to help deliver a great user experience for everyone and not to break existing installations.

Can I help implement this? 👩‍💻👨‍💻

• Yes
• No

[jokob-sk]

Requirements:

Must haves

1. needs to be in the devMac field
2. Fake obvious

Unsure

1. HEX Valid?
2. MAC-Format Valid?

Fake Address Representation Options — Comparison Table

Format Example	HEX Valid?	MAC-Format Valid?	Human Readability (Fake obvious?)	Parser Safety (Regex/Validators)	Semantic Safety (not multicast/broadcast)	Easy for Users?	Good for Internals?	Notes
02:FA:CE:00:00:01	✔️ Yes	✔️ Yes	⚠️ Medium	✔️ Very safe	✔️ Safe (unicast, LAA)	⚠️ Medium	⭐ Excellent	Best all-around fake MAC that still behaves like a real MAC
F0:FA:CE:00:00:01	✔️ Yes	✔️ Yes	✔️ Good (visually distinctive)	✔️ Safe	✔️ Safe	✔️ Good	⭐ Excellent	Nice compromise: valid MAC + readable “FA:CE” hex pattern
FA:KE:00:00:01:02	❌ No	❌ No	⭐ Very high	❌ Breaks parsing	❌ Invalid due to non-hex	✔️ Easy	❌ Unusable	INVALID — letters must be 0-9, A-F only
FF:00:00:00:01:02	✔️ Yes	✔️ Yes	⚠️ Looks unusual	✔️ Parses fine	❌ Multicast/broadcast (I/G bit = 1)	⚠️ Unclear	⚠️ Risky	Avoid — may trigger special-case logic in tools
AA:FA:KE:00:00:01	❌ No	❌ No	⭐ Clear	❌ Not parseable	❌ Invalid	✔️ Clear	❌ Not usable	Same issue as FA:KE — invalid MAC characters
ip-192.168.1.20	✔️ N/A	❌ No	⭐ Extremely clear	✔️ Very safe	✔️ Safe	⭐ Very easy	⚠️ Not MAC-compatible	Best for IP-only or synthetic identifiers, not for MAC fields
device-tmp-1234	✔️ N/A	❌ No	⭐ Clear	✔️ Safe	✔️ Safe	⭐ Easy	⚠️ Not MAC-compatible	Good for placeholders, not tied to networking
UUID (e.g., 550e…440000)	✔️ N/A	❌ No	⚠️ Low	✔️ Safe	✔️ Safe	❌ Too long	⚠️ Overkill	Valid but impractical for NetAlertX use cases

[jokob-sk]

Settled on FA:CE:<rest>

[jokob-sk]

Releasing -> Closing