diff --git a/Changes b/Changes
index b68a0695..6fad14ec 100644
--- a/Changes
+++ b/Changes
@@ -1,3 +1,9 @@
+2.039022 - 2018-04-
+
+  [BUG FIXES]
+
+  * clean up check_mac() interface (ml-cms)
+
 2.039021 - 2018-04-10
 
   [BUG FIXES]
diff --git a/bin/netdisco-sshcollector b/bin/netdisco-sshcollector
index d77932a1..f387758e 100755
--- a/bin/netdisco-sshcollector
+++ b/bin/netdisco-sshcollector
@@ -143,7 +143,7 @@ sub store_arpentries {
 
     foreach my $arpentry ( @$arpentries ) {
         # skip broadcast/vrrp/hsrp and other wierdos
-        next unless check_mac( undef, $arpentry->{mac} );
+        next unless check_mac( $arpentry->{mac} );
 
         debug sprintf '  arpnip - stored entry: %s / %s',
             $arpentry->{mac}, $arpentry->{ip};
diff --git a/lib/App/Netdisco/Util/Nbtstat.pm b/lib/App/Netdisco/Util/Nbtstat.pm
index 4b0cccab..b0a4478a 100644
--- a/lib/App/Netdisco/Util/Nbtstat.pm
+++ b/lib/App/Netdisco/Util/Nbtstat.pm
@@ -116,7 +116,7 @@ sub _filter_nbname {
 
     my $mac = $node_status->{'mac_address'} || '';
 
-    unless ( check_mac( $ip, $mac ) ) {
+    unless ( check_mac( $mac, $ip ) ) {
 
         # Just assume it's the last MAC we saw this IP at.
         my $node_ip = schema('netdisco')->resultset('NodeIp')
diff --git a/lib/App/Netdisco/Util/Node.pm b/lib/App/Netdisco/Util/Node.pm
index 7cc832bc..5bc598e0 100644
--- a/lib/App/Netdisco/Util/Node.pm
+++ b/lib/App/Netdisco/Util/Node.pm
@@ -28,11 +28,10 @@ subroutines.
 
 =head1 EXPORT_OK
 
-=head2 check_mac( $device, $node, $port_macs? )
+=head2 check_mac( $node, $device?, $port_macs? )
 
-Given a Device database object and a MAC address, perform various sanity
-checks which need to be done before writing an ARP/Neighbor entry to the
-database storage.
+Given a MAC address, perform various sanity checks which need to be done
+before writing an ARP/Neighbor entry to the database storage.
 
 Returns false, and might log a debug level message, if the checks fail.
 
@@ -50,6 +49,8 @@ MAC address is not all-zero, broadcast, CLIP, VRRP or HSRP
 
 =back
 
+Optionally pass a Device instance or IP to use in logging.
+
 Optionally pass a cached set of Device port MAC addresses as the third
 argument, in which case an additional check is added:
 
@@ -64,11 +65,11 @@ MAC address does not belong to an interface on any known Device
 =cut
 
 sub check_mac {
-  my ($device, $node, $port_macs) = @_;
-  return 0 if !$device or !$node;
+  my ($node, $port_macs, $device) = @_;
+  return 0 if !$node;
 
   my $mac = NetAddr::MAC->new(mac => $node);
-  my $devip = (ref $device ? $device->ip : '');
+  my $devip = ($device ? (ref $device ? $device->ip : $device) : '');
   $port_macs ||= {};
 
   # incomplete MAC addresses (BayRS frame relay DLCI, etc)
diff --git a/lib/App/Netdisco/Web/Plugin/AdminTask/NodeMonitor.pm b/lib/App/Netdisco/Web/Plugin/AdminTask/NodeMonitor.pm
index 59b3c1ef..98aa716b 100644
--- a/lib/App/Netdisco/Web/Plugin/AdminTask/NodeMonitor.pm
+++ b/lib/App/Netdisco/Web/Plugin/AdminTask/NodeMonitor.pm
@@ -15,9 +15,9 @@ register_admin_task({
 
 sub _sanity_ok {
     return 0 unless param('mac')
-      and check_mac(undef, param('mac'));
+      and check_mac(param('mac'));
 
-    params->{mac} = check_mac(undef, param('mac'));
+    params->{mac} = check_mac(param('mac'));
     return 1;
 }
 
diff --git a/lib/App/Netdisco/Worker/Plugin/Arpnip/Nodes.pm b/lib/App/Netdisco/Worker/Plugin/Arpnip/Nodes.pm
index a9620376..6805737a 100644
--- a/lib/App/Netdisco/Worker/Plugin/Arpnip/Nodes.pm
+++ b/lib/App/Netdisco/Worker/Plugin/Arpnip/Nodes.pm
@@ -48,7 +48,7 @@ sub get_arps {
   while (my ($arp, $node) = each %$paddr) {
       my $ip = $netaddr->{$arp};
       next unless defined $ip;
-      next unless check_mac($device, $node);
+      next unless check_mac($node, $device);
       push @arps, {
         node => $node,
         ip   => $ip,
diff --git a/lib/App/Netdisco/Worker/Plugin/Macsuck/Nodes.pm b/lib/App/Netdisco/Worker/Plugin/Macsuck/Nodes.pm
index 488585c2..b46e78a4 100644
--- a/lib/App/Netdisco/Worker/Plugin/Macsuck/Nodes.pm
+++ b/lib/App/Netdisco/Worker/Plugin/Macsuck/Nodes.pm
@@ -281,7 +281,7 @@ sub walk_fwtable {
 
   while (my ($idx, $mac) = each %$fw_mac) {
       my $bp_id = $fw_port->{$idx};
-      next unless check_mac($device, $mac);
+      next unless check_mac($mac, $device);
 
       unless (defined $bp_id) {
           debug sprintf