Can I determine approximate date of manufacture based on MAC address?

  • 1
  • Question
  • Updated 2 months ago
  • Answered
  • (Edited)
We found a few Ruckus AP's broadcasting similar names to my client's corporate SSID, but they may be on different floors of our building - that were leased to a different company many years ago.

They are not on my client's floors (weak signal only in one corner near a window) but due to the similarity in SSIDs have now gotten the attention of the security department. They may be on floors higher up  in the building- since my client used to own those floors.

We are curious if the detected MAC addresses could indicate the possible date of manufacture. That could at least indicate if this theory is possible- that they may have been installed years ago, never removed, and left powered.

Getting access to those floors for inspection is not possible yet, without major bureaucratic corporate decisions, hence trying to discern as much as possible with given information.

Sample addresses:
2C:5D:93:14:9E:AC
38:FF:36:17:6A:78
C0:8A:DE:A2:C8:C8

Thanks
Charles

Photo of Charles Patterson

Charles Patterson

  • 6 Posts
  • 0 Reply Likes
  • curious

Posted 3 months ago

  • 1
Photo of Mikhail Starozhilov

Mikhail Starozhilov

  • 30 Posts
  • 3 Reply Likes
Hi Charles.
All of the above addresses belong, according to the site macvendors.com, to Ruckus Wireless. You can write them a request, but IMHO will not help you, as the equipment could be stored for a long time before it was sold.
But could you tell me why your SSID's “similarity” worried you? Is it possible to use your wireless network without a password?!!
(Edited)
Photo of Charles Patterson

Charles Patterson

  • 6 Posts
  • 0 Reply Likes
Hi, thanks for the reply.
The concern for the security director is mainly due diligence. It's a multi national company so they want to be sure of what is going on. He's looking to me to help explain why he should or shouldn't be worried.
They first were concerned that someone was trying to harvest login credentials by spoofing their own network. I don't think that is the case. Knowing if these were older units might help form a picture of what is going on.

Thanks
Photo of Jardel Almeida

Jardel Almeida

  • 37 Posts
  • 3 Reply Likes
Initially I would try to contact the IT manager responsible for the LAN / WLAN, and ask him to consult via cdp / lldp if the MACs are associated in some interface of the switch, and would request the blocking of these APs (since he has nothing or nobody associated.


PS: I believe that the date of manufacture is irrelevant, the ideal would be to identify the models, to know if it is dual band, to identify the IP address, if they are running behind controllers, or if they are stand-alone.

Thus, some action (removal / configuration) would be easier with respect to the SSID.
Photo of Charles Patterson

Charles Patterson

  • 6 Posts
  • 0 Reply Likes
The current IT department only goes back 4 years and they do not (apparently) have any records from before that, as there were major changes then- including a full remodel of the building and all infrastructure- and giving up most of the building to other tenants.
Knowing the approx date of manufacture was just one avenue I was considering to see if the units may have been from that far back.
Thanks
Photo of Mikhail Starozhilov

Mikhail Starozhilov

  • 30 Posts
  • 3 Reply Likes
Alas, Charles, if the information network of the building is decentralized, then you will have to solve this problem with bureaucratic methods.

Photo of Charles Patterson

Charles Patterson

  • 6 Posts
  • 0 Reply Likes
Yeah, that's what I told them!  Everybody wants some magic answer.
Thanks
Photo of Michael Brado

Michael Brado, Official Rep

  • 2701 Posts
  • 376 Reply Likes
Hi Charles,
    Unfortunately, the AP MAC address, which is used to represent up to 15 wireless SSIDs, does not help date the AP. The Serial number of an AP, has date code details.
    Can you connect to any of those similar SSIDs seen in that upstairs area?  I'd also suggest a wireless trace, to really see all that's in the air.

 
Photo of Charles Patterson

Charles Patterson

  • 6 Posts
  • 0 Reply Likes
Hi Michael,
Thanks for the reply. I'm working to educate the security director on such things as why there are multiple SSIDs and multiple MAC addresses detected, even though there may only be a few actual APs with those IDs/addresses.
The signals were too weak to connect to from within my client's offices, and as mentioned, they are resisting trying to contact the upstairs tenant (that's out of my pay-grade). We'll see what happens down the road.
Thanks
Charles
Photo of Andrew Giancola

Andrew Giancola

  • 29 Posts
  • 10 Reply Likes
if it helps at all, 2C:5D:93 - is the same as many of my older 7982's. 38:FF:36, could be an R600. C0:8A:D shows to be 7982's as well.

Good luck, happy hunting.

Photo of Charles Patterson

Charles Patterson

  • 6 Posts
  • 0 Reply Likes
Andrew, about how old (years?) are the units you mentioned?
Photo of Andrew Giancola

Andrew Giancola

  • 29 Posts
  • 10 Reply Likes
i don't have easy access to those records, but here are the serial numbers for these units, perhaps Michael can look them up?
351205000942 -  7982 - c08a.de
461303001743 -7982- 2c5d.93
441503100298 - R600 - 38ff.36


Photo of Michael Brado

Michael Brado, Official Rep

  • 2701 Posts
  • 376 Reply Likes
Hello,
   The first 4 digits of the S/N indicate manufacturing date.  So, the 35th week of 2012 for the first 7982, 46th week of 2013 for the second 7982, and the 44th week of 2015 for your R600.
Photo of Michael Brado

Michael Brado, Official Rep

  • 2701 Posts
  • 376 Reply Likes
...and a 99xx, means Jan of that year.