After a quick check, it turns out it’s the administrator’s responsibility to set that bit if he changes the MAC address.

So yeah, you can put a locally administrated mac address that appears to be a globally unique mac address.

So you can always just check the “Globally Unique” bit and guess the mac address is spoofed …

Wonder if anyone made an iptables filter for those actually .. block them off my network …