> > looks like someone is using tools like ettercap. It could either be that - ARP cache poisoning - or some sort of clustering software which uses changing MAC addresses (seen that).