Mac addresses in alert listing do not match device mac address
I have been trying to trace a reported attempted intrusion in the alert history and assumed that the mac address would identify the device attempting to contact a blocked site. Turns out none of the wireless mac addresses match any of my devices. Some devices where names are displayed, dougs-ipad for example, but the mac address for this device doesn't match dougs-ipad. Some entries have the device named the same as the mac address bit i assume these are ficticious also.
I also note that the mac addresses you display on the device details do not match what the device advertises as its mac address.
Why is this? How am i supposed to trace a problem with phoney mac addresses?