Joined: 15 Apr 2009 Posts: 43 Location: Southern California
Posted: Thu Feb 04, 2010 0:51 Post subject: Phantom device keeps showing up (despite MAC filtering!)
I have a WRT320Nv1 that has 13575M NEWD-2 K2.6 Eko installed. It works fine.
But...there is a device that keeps showing up, despite my ONLY allowing specified MAC addresses to get on the wireless network. The phantom device shows up even though it's not allowed?!
The phantom device MAC address is 00:24:2B:56:4C:0D and when I click on it it shows up as being a device "Hon Hai Precision Ind.Co.,Ltd". See screenshot.
I wonder if this is something normal, associated with the WRT320Nv1 device? Or, is there a chance someone is spoofing the MAC address of one of my allowed devices and getting in? The reason I suspect spoofing is the occasional "Another device on the network is using your computer's IP address (192.168.61.2)".
What's weird, if someone was spoofing an allowed MAC address, why would it in fact show up with a MAC address that isn't in my "allowed" list of MAC addresses?
Joined: 13 Nov 2008 Posts: 5266 Location: CENTRAL Midnowhere
Posted: Thu Feb 04, 2010 1:39 Post subject:
I expect you will find that that is the maker of the NIC device in your computer. I had a problem with OSx recognizing my device as already connected, and having to issue another lease to me. It kept changing the name of my computer name in OSX to laptop(1), laptop(356) etc.
To see connected devices, look at your system/lan page
While I cannot explain exactly what is causing this, my experience is that this is not a security issue, but a networking issue. Perhaps you have more than one dhcp server on the network? _________________ Warning: I'm "out of my element!"
http://www.youtube.com/watch?v=MjYJ7zZ9BRw&NR=1
Joined: 15 Apr 2009 Posts: 43 Location: Southern California
Posted: Thu Feb 04, 2010 3:42 Post subject:
Donny wrote:
I expect you will find that that is the maker of the NIC device in your computer. I had a problem with OSx recognizing my device as already connected, and having to issue another lease to me. It kept changing the name of my computer name in OSX to laptop(1), laptop(356) etc.
To see connected devices, look at your system/lan page
While I cannot explain exactly what is causing this, my experience is that this is not a security issue, but a networking issue. Perhaps you have more than one dhcp server on the network?
Hi Donny,
I keep a very detailed spreadsheet of all the devices on our network, including the MAC addresses of every port on each device. The MAC address that's showing up is consistent, and shows up whether my Mac or PC are on the network or not. It's definitely a phantom device.
I think I'll turn off MAC filtering and go back to using WPA2. The only issue there, if I'm not at home and someone fiddles with the wireless connection, they'll need the password to get back on. I was using MAC filtering to avoid having to do that.
Joined: 13 Nov 2008 Posts: 5266 Location: CENTRAL Midnowhere
Posted: Thu Feb 04, 2010 3:59 Post subject:
You likely know how ridiculously unsecure mac filter is.
However, check the Status/Lan and see if they are actually connected, and have a meaningful connection count.
That company is Foxconn, who make amongst other things, Ipods, Wiis, Nintendo, Xbox, etc. Perhaps you missed a device or have a guest who brings a Touch over?
Joined: 15 Apr 2009 Posts: 43 Location: Southern California
Posted: Thu Feb 04, 2010 5:22 Post subject:
Donny wrote:
You likely know how ridiculously unsecure mac filter is.
However, check the Status/Lan and see if they are actually connected, and have a meaningful connection count.
That company is Foxconn, who make amongst other things, Ipods, Wiis, Nintendo, Xbox, etc. Perhaps you missed a device or have a guest who brings a Touch over?
Mac filtering would not work on a bridged device, btw.
Yes, I know MAC filtering is not secure, the WRT320Nv1 is set to AP (not bridging). I switched to WPA2 and I manually configured the Mac and PC so they're both set up to connect automatically to the wifi network. I'll keep an eye on things to see if the device shows up again. Thanks for your help!
Posted: Wed Jan 03, 2018 0:17 Post subject: *bump* Any news? n/t
donmontalvo wrote:
Donny wrote:
You likely know how ridiculously unsecure mac filter is.
However, check the Status/Lan and see if they are actually connected, and have a meaningful connection count.
That company is Foxconn, who make amongst other things, Ipods, Wiis, Nintendo, Xbox, etc. Perhaps you missed a device or have a guest who brings a Touch over?
Mac filtering would not work on a bridged device, btw.
Yes, I know MAC filtering is not secure, the WRT320Nv1 is set to AP (not bridging). I switched to WPA2 and I manually configured the Mac and PC so they're both set up to connect automatically to the wifi network. I'll keep an eye on things to see if the device shows up again. Thanks for your help!
I presume since the OP hasn't been back to report anything that he hasn't seen any issues since. Probably may have moved from the original HW to something newer as well.