When working with Linux bonding interfaces (bond0, bond1, etc.), the physical NICs' original MAC addresses get replaced by the bond's MAC address. This becomes problematic when you need to:

• Identify specific physical interfaces in a large server farm
• Troubleshoot networking issues where switch logs show physical NIC MACs
• Audit hardware inventory without physical access

When dmesg and log files aren't available, try these approaches:

Method 1: Using sysfs

The most reliable way to get original MAC addresses:
cat /sys/class/net/eth0/address
cat /sys/class/net/eth1/address

For a script to check all interfaces:

#!/bin/bash
for interface in /sys/class/net/*; do
    if [[ "$interface" != *"bond"* ]]; then
        echo "${interface##*/}: $(cat $interface/address)"
    fi
done

Method 2: ethtool Utility

ethtool can reveal permanent hardware addresses:
sudo ethtool -P eth0
sudo ethtool -P eth1

Method 3: PCI Device Inspection

When drivers store MACs in PCI config space:

lspci -nn | grep -i ethernet
sudo lshw -class network

Here's how to search multiple servers for a specific MAC address found in Cisco switch logs:

#!/bin/bash
TARGET_MAC="00:1a:2b:3c:4d:5e"
SERVER_LIST="server{1..50}.example.com"

parallel-ssh -H "$SERVER_LIST" -i \
'for nic in /sys/class/net/eth*; do 
    mac=$(cat $nic/address); 
    [[ "$mac" == "'"$TARGET_MAC"'" ]] && \
    echo "$(hostname): $nic has MAC $mac"; 
done'

The bonding driver changes MAC addresses based on mode:

• Active-Backup: Slave MACs change to bond MAC when active
• LACP: Slave MACs remain visible to switches
• Balance-RR: MAC flapping occurs as bond changes active slave

For persistent MAC checks, consider updating your monitoring to capture NIC MACs before bonding initialization during boot.

For servers with IPMI/BMC:
ipmitool lan print
For Dell servers:
racadm getsysinfo

When working with bonded network interfaces in Linux (bond0), you'll notice that both physical NICs (eth0 and eth1) report the same MAC address through standard tools like ifconfig or ip link show. This behavior is by design - the bonding driver uses a single MAC address for the virtual interface.

Here are several methods to retrieve the original hardware MAC addresses:

# Method 1: Check network manager logs
grep -i "eth[01]" /var/log/syslog* | grep -i "mac"

# Method 2: Query sysfs directly
cat /sys/class/net/eth0/address
cat /sys/class/net/eth1/address

# Method 3: Use ethtool (requires root)
sudo ethtool -P eth0
sudo ethtool -P eth1

Even if your system logs have rotated, you might still find MAC addresses in the kernel ring buffer:

dmesg | grep -E 'eth[01]|mac|network'

Here's a bash script to search for a specific MAC across multiple servers via SSH:

#!/bin/bash
TARGET_MAC="00:1a:2b:3c:4d:5e"
SERVERS=("server1" "server2" "server3")

for server in "${SERVERS[@]}"; do
    echo "Checking $server..."
    ssh $server "for iface in eth0 eth1; do \
        mac=$(cat /sys/class/net/\$iface/address 2>/dev/null); \
        [ \"\$mac\" = \"$TARGET_MAC\" ] && echo \"Found on \$iface: \$mac\"; \
    done"
done

If you can't retrieve the MACs through software methods, you might need to:

• Check the physical NIC labels (if accessible)
• Use the server's management interface (iDRAC, iLO, etc.)
• Consult the original procurement documentation

The bonding driver typically uses one of these MAC address modes:

# Check current bonding mode
cat /proc/net/bonding/bond0 | grep "Bonding Mode"

Common modes include:
- active-backup (MAC changes during failover)
- balance-alb (uses single MAC for all interfaces)