Phantom device keeps showing up (despite MAC filtering!)

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
donmontalvo
DD-WRT Novice


Joined: 15 Apr 2009
Posts: 43
Location: Southern California

PostPosted: Thu Feb 04, 2010 0:51    Post subject: Phantom device keeps showing up (despite MAC filtering!) Reply with quote
I have a WRT320Nv1 that has 13575M NEWD-2 K2.6 Eko installed. It works fine.

But...there is a device that keeps showing up, despite my ONLY allowing specified MAC addresses to get on the wireless network. The phantom device shows up even though it's not allowed?!

The phantom device MAC address is 00:24:2B:56:4C:0D and when I click on it it shows up as being a device "Hon Hai Precision Ind.Co.,Ltd". See screenshot.

I wonder if this is something normal, associated with the WRT320Nv1 device? Or, is there a chance someone is spoofing the MAC address of one of my allowed devices and getting in? The reason I suspect spoofing is the occasional "Another device on the network is using your computer's IP address (192.168.61.2)".

What's weird, if someone was spoofing an allowed MAC address, why would it in fact show up with a MAC address that isn't in my "allowed" list of MAC addresses?

Any thoughts?

Don



Conflicting_IP_Address.jpg
 Description:
 Filesize:  41 KB
 Viewed:  21727 Time(s)

Conflicting_IP_Address.jpg



Phantom_Device.jpg
 Description:
 Filesize:  77.91 KB
 Viewed:  21727 Time(s)

Phantom_Device.jpg


Sponsor
Donny
DD-WRT Guru


Joined: 13 Nov 2008
Posts: 5266
Location: CENTRAL Midnowhere

PostPosted: Thu Feb 04, 2010 1:39    Post subject: Reply with quote
I expect you will find that that is the maker of the NIC device in your computer. I had a problem with OSx recognizing my device as already connected, and having to issue another lease to me. It kept changing the name of my computer name in OSX to laptop(1), laptop(356) etc.

To see connected devices, look at your system/lan page

While I cannot explain exactly what is causing this, my experience is that this is not a security issue, but a networking issue. Perhaps you have more than one dhcp server on the network?

_________________
Warning: I'm "out of my element!"
http://www.youtube.com/watch?v=MjYJ7zZ9BRw&NR=1

Peacock Thread Sticky- Just read it! (Anyone using SP1 will be taken out back and shot)
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=51486
donmontalvo
DD-WRT Novice


Joined: 15 Apr 2009
Posts: 43
Location: Southern California

PostPosted: Thu Feb 04, 2010 3:42    Post subject: Reply with quote
Donny wrote:
I expect you will find that that is the maker of the NIC device in your computer. I had a problem with OSx recognizing my device as already connected, and having to issue another lease to me. It kept changing the name of my computer name in OSX to laptop(1), laptop(356) etc.

To see connected devices, look at your system/lan page

While I cannot explain exactly what is causing this, my experience is that this is not a security issue, but a networking issue. Perhaps you have more than one dhcp server on the network?


Hi Donny,

I keep a very detailed spreadsheet of all the devices on our network, including the MAC addresses of every port on each device. The MAC address that's showing up is consistent, and shows up whether my Mac or PC are on the network or not. It's definitely a phantom device.

I think I'll turn off MAC filtering and go back to using WPA2. The only issue there, if I'm not at home and someone fiddles with the wireless connection, they'll need the password to get back on. I was using MAC filtering to avoid having to do that.

Don
Donny
DD-WRT Guru


Joined: 13 Nov 2008
Posts: 5266
Location: CENTRAL Midnowhere

PostPosted: Thu Feb 04, 2010 3:59    Post subject: Reply with quote
You likely know how ridiculously unsecure mac filter is.

However, check the Status/Lan and see if they are actually connected, and have a meaningful connection count.

That company is Foxconn, who make amongst other things, Ipods, Wiis, Nintendo, Xbox, etc. Perhaps you missed a device or have a guest who brings a Touch over?

Mac filtering would not work on a bridged device, btw.

_________________
Warning: I'm "out of my element!"
http://www.youtube.com/watch?v=MjYJ7zZ9BRw&NR=1

Peacock Thread Sticky- Just read it! (Anyone using SP1 will be taken out back and shot)
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=51486
donmontalvo
DD-WRT Novice


Joined: 15 Apr 2009
Posts: 43
Location: Southern California

PostPosted: Thu Feb 04, 2010 5:22    Post subject: Reply with quote
Donny wrote:
You likely know how ridiculously unsecure mac filter is.

However, check the Status/Lan and see if they are actually connected, and have a meaningful connection count.

That company is Foxconn, who make amongst other things, Ipods, Wiis, Nintendo, Xbox, etc. Perhaps you missed a device or have a guest who brings a Touch over?

Mac filtering would not work on a bridged device, btw.


Yes, I know MAC filtering is not secure, the WRT320Nv1 is set to AP (not bridging). I switched to WPA2 and I manually configured the Mac and PC so they're both set up to connect automatically to the wifi network. I'll keep an eye on things to see if the device shows up again. Thanks for your help!

Don
planetjoke
DD-WRT Novice


Joined: 03 Jan 2018
Posts: 1

PostPosted: Wed Jan 03, 2018 0:17    Post subject: *bump* Any news? n/t Reply with quote
donmontalvo wrote:
Donny wrote:
You likely know how ridiculously unsecure mac filter is.

However, check the Status/Lan and see if they are actually connected, and have a meaningful connection count.

That company is Foxconn, who make amongst other things, Ipods, Wiis, Nintendo, Xbox, etc. Perhaps you missed a device or have a guest who brings a Touch over?

Mac filtering would not work on a bridged device, btw.


Yes, I know MAC filtering is not secure, the WRT320Nv1 is set to AP (not bridging). I switched to WPA2 and I manually configured the Mac and PC so they're both set up to connect automatically to the wifi network. I'll keep an eye on things to see if the device shows up again. Thanks for your help!

Don


Curious, even 7 years later. Rolling Eyes
FurryNutz
DD-WRT User


Joined: 31 Oct 2010
Posts: 204

PostPosted: Wed Jan 03, 2018 0:22    Post subject: Reply with quote
I presume since the OP hasn't been back to report anything that he hasn't seen any issues since. Probably may have moved from the original HW to something newer as well. Wink
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum