A customer asked, why does their network monitoring software report a device from ViaVideo Communications when it's a Polycom device? Is something wrong? Was it hacked?
Nothing's wrong! To understand, you do need to understand what the monitoring software is doing and a little bit about how ethernet works.
Background
When you acquire any device that has either a wired or wireless network interface, that interface has a MAC address--an unique identifier from the manufacturer that others device on the local network can use to communicate with that device. It's layer 2 of of the OSI model. These MAC addresses are hard coded into the network interfaces.1 They're made of two parts, a part that identifies the manufacturer, and then second part that's unique within a the manufacturer's.
The IEEE Registration Authority (IEEE-RA) administers the assignment of 24-bit identifiers, formally known as an "Organizationally Unique Identifier" (OUI) that identifies the manufacturer.
What your network monitoring tool may be doing is taking the unique OUI, looking it up against the original IEEE-RA database and then reporting the company name that was assigned that OUI.
Polycom has made several acquisitions since 1998, including:
| January 1998 |
ViaVideo |
appliance-based video communications systems |
|
| February 2001 |
Accord Networks |
provider of MCUs |
|
| April 2001 |
Circa Communications |
IP telephony products |
|
| October 2001 |
PictureTel |
PC-based video communications systems |
|
| December 2001 |
ASPI Digital |
installed voice systems |
|
| January 2004 |
Voyant Technologies |
voice conferencing and collaboration network solutions |
|
| August 2005 |
DST Media |
China-based video networking company |
|
| March 2007 |
SpectraLink and KIRK telecom |
workplace wireless telephony (since divested) |
|
Here's the root of the problem: Not all the OUIs have been updated with IEEE-RA to change from "ViaVideo" or "Accord Networks" to reflect Polycom's ownership.
In this case, the network monitoring tool is querying the MAC address of a device, parsing out the OUI, looking up the OUI in the IEEE database and returning what it sees. It's reporting "ViaVideo" becuase that's what the IEEE database says. There's nothing wrong with your equiment, just some old data.
Unfortunately, this is actually common. A Google Chromecast report as from Azurewave Technologies, notebook computers might show as Intel (they have some very common chipsets), Wistron InfoComm (Kunshan)Co for Lenovo, Hon Hai Precision for Dell, etc.
Bad news is that the tool's only reporting what it knows. The good news is that it's expected behavior and nothing is wrong. If anyone asks, everything is working properly, just reporting old news.
1-- While MAC Addresses are hard coded, many devices let you override the default MAC Address in software. Why you might want to do this is well beyond the scope of this discussion.
