Endpoint Protection

Just a quick question.  I know this seems obvious but I am seeing some interesting things.  In the Traffic Log there are a couple of columns for Remote MAC & Local MAC.  Where is this information gathered?  I would generally think that Remote MAC is for the host of the incoming packet & the Local MAC would be the MAC of the local PC that the log is located on.  However, I see at least two different MAC's in the Local MAC column that don't match any of the MAC's that windows shows.

Is it possible that these MAC's are coming from a datagram on a switch or... I can't think of anything else.

Any knowledge or hints int he right direction are appreciated.

Thanks...

 

• Local MAC (Local View)

  MAC address of the local computer. If outside the subnet, it is the MAC address of the router.

• Destination MAC (Source View)

  MAC address of the destination computer.
  
  
  

  • Remote MAC (Local View)

    MAC address of the remote computer. If outside the subnet, it is the MAC address of the router.

  • Source MAC (Source View)

    MAC address of the source computer.