Unknown Wireless Connections (w/ Secure Password)

[MatthewH16]

So I'm having a weird issue with my ASUS RT-ac56U running MerlinWRT 378.50, though as a test I just upgraded to 378.51B1. I noticed starting about a month or so ago, unknown devices in my Wireless DHCP Lease log. Now Ive had this router in the same location, with the same setup (except for MerlinWRT upgrades, and the changes noted below) for almost 6 months now and never had this issue up until about a month or so ago.

Every day or so, I see a different unknown device under my DHCP Lease log (My devices are all static from 192.168.1.1-192.168.1.6x) with DHCP Dynamic leases starting at .100 and going through .254, which makes these unknown devices easy to pick out. I live with my GF but I know every device we both own, and every device is assigned a static IP, and I connected every one of them (she can never remember the wireless key) so I know these are not our devices.

I have a custom network name for both of my networks, and my security is using WPA2 with a ~20 character password consisting of uppercase, lowercase, numbers and symbols, so I don't think it'd be practical for anyone to be hacking my password, especially since I've seen 4 different devices so far. I also have WPS and the Guest networks turned off.

I've tried changing my network name, and password multiple times, and even tried resetting the router to defaults and setting everything up from scratch. I've resorted to blocking them by mac-address when I see them both inside the wireless mac filter, and via DNSMasq but I really want to know whats going on here.

Any ideas whats going on? It's odd because while I see them under the DHCP Leases log, I never see these devices under the Wireless Log list, so it's almost as if these devices try to connect, get an IP address and then never stay connected.

Are these people actually connecting and getting access to my network, or is something else going on?

Thanks for any help, I'd love to get this resolved ASAP as I am a super security conscious person.

 

[ColinTaylor]

Could you give us the list of MAC addresses you are blocking please? It might provide some sort of clue as to the problem.

 

[CaptainSTX]

Just for grins beg or borrow from someone a WiFi enabled device and then associate this unknown device with your network but don't connect it by entering the paraphrase. Look at your log and see if the MAC address of this device shows up requesting from your DHCP server an IP.

If it does then you can be fairly sure what is happening for what ever reason be it inadvertent or less likely malicious one of your nearby neighbors' Wifi device(s) is trying to connect to your network. This could be happening because your signal is stronger than their WiFi and mobile devices look to connect to the strongest signal.

These connection attempts won't hurt anything, but if you can determine who the devices belong to you can ask them to have their devices forget your network SSIDs. Of course if they take it wrong and think you are accusing them of trying to hack your network you will have one less person in the neighborhood speaking to you.

 

[MatthewH16]

Here's the Mac Addresses I've seen so far:

d0:22:be:aa:a6:8a
4c:7c:5f:31:15:2c
f2:27:93:5b:48:0f