What is this in my log?

[lostindark]

Hi can you help me with that, I have strange Mac in my log list:



Apr 3 22:55:57 roamast: wl0.1: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 22:59:07 roamast: eth5: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 23:02:17 roamast: wl0.1: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 22:55:57 roamast: wl0.1: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 22:59:07 roamast: eth5: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 23:02:17 roamast: wl0.1: add client [00:08:22:3b:dd:87] to monitor list


This is not my device.. but what can be?


Sent from my SM-G930F using Tapatalk

 

[DonnyJohnny]

Hi can you help me with that, I have strange Mac in my log list:



Apr 3 22:55:57 roamast: wl0.1: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 22:59:07 roamast: eth5: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 23:02:17 roamast: wl0.1: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 22:55:57 roamast: wl0.1: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 22:59:07 roamast: eth5: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 23:02:17 roamast: wl0.1: add client [00:08:22:3b:dd:87] to monitor list


This is not my device.. but what can be?


Sent from my SM-G930F using Tapatalk

If you don’t know who know?

Repeater? Smart tv? Wireless cam? PC with secondary wifi card? Your wireless watch? Anything using internet wireless? Fridge? Aircon.. IOT?

If not, too bad.. your router has been compromised by your neighbour due to weak wifi password and suggest you reflush and factory reset with stronger password.

 

[lostindark]

If you don’t know who know?

Repeater? Smart tv? Wireless cam? PC with secondary wifi card? Your wireless watch? Anything using internet wireless? Fridge? Aircon.. IOT?

If not, too bad.. your router has been compromised by your neighbour due to weak wifi password and suggest you reflush and factory reset with stronger password.

Thanks but this device doesn't take ip address from my router but every 3 minutes show this on the log.. even after restart .. this is not my device. I'm using dhcp for every device and this Mac address doesn't appear in the list.

Also This Mac don't figure at my dhcp leases list or wireless log.

Sent from my SM-G930F using Tapatalk

 

[john9527]

If it helps, that mac belongs to 'InPro Comm'

 

[DonnyJohnny]

If it helps, that mac belongs to 'InPro Comm'

Nice catch..

From https://en.m.wikipedia.org/wiki/Inprocomm
“Inprocomm produced seven wireless chip designs in total, along with accompanying reference designs for PCI, mini-PCI and CardBus. IPN2120 and IPN2220 are the most common; in particular, D-Link used an IPN2220 chip in their DI-624M router, and Linksys used the IPN2120 in some of their PCI cards (such as the WMP11 version 4) and mini-PCI cards. Linksys mini-PCI cards with IPN2220 can be found in some of the 2004 laptop models, such as the TravelMate 2300 and Aspire 1520 series from Acer, and the Packard Bell EasyNote A5560. Inprocomm chips have also been used in Buffalo and Toshiba products.[1]”

 

[lostindark]

Nice catch..

From https://en.m.wikipedia.org/wiki/Inprocomm
“Inprocomm produced seven wireless chip designs in total, along with accompanying reference designs for PCI, mini-PCI and CardBus. IPN2120 and IPN2220 are the most common; in particular, D-Link used an IPN2220 chip in their DI-624M router, and Linksys used the IPN2120 in some of their PCI cards (such as the WMP11 version 4) and mini-PCI cards. Linksys mini-PCI cards with IPN2220 can be found in some of the 2004 laptop models, such as the TravelMate 2300 and Aspire 1520 series from Acer, and the Packard Bell EasyNote A5560. Inprocomm chips have also been used in Buffalo and Toshiba products.[1]”

Thanks but again as i say .. this device doesn't take ip address from my router but in my log it shows like added...


Apr 3 22:55:57 roamast: wl0.1: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 22:59:07 roamast: eth5: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 23:02:17 roamast: wl0.1: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 22:55:57 roamast: wl0.1: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 22:59:07 roamast: eth5: add client [00:08:22:3b:dd:87] to monitor list
Apr 3 23:02:17 roamast: wl0.1: add client [00:08:22:3b:dd:87] to monitor list

Also it show once at wl0.1 interface other time eth5 .. I don't understand..

Someone to help?

Sent from my SM-G930F using Tapatalk

 

[ColinTaylor]

Roaming assistant. Just because a random client is trying to associate with your Wi-Fi doesn't mean that it is authorised, which is why it's not given an IP address.

 

[DonnyJohnny]

Roaming assistant. Just because a random client is trying to associate with your Wi-Fi doesn't mean that it is authorised, which is why it's not given an IP address.

He mentioned every 3 min he see this log. Isn’t this bad? Someone trying to enter the router?

 

[lostindark]

He mentioned every 3 min he see this log. Isn’t this bad? Someone trying to enter the router?

Yes, maybe some neighbour try to reach my internet and he is enter some wrong password. But this device try to connect every 3 minutes. Wl0.1 is my guest network and eth5 is my 2.4 ghz network.


I've made experiments with other device and when you enter wrong password log list say ADD but doesn't give ip address.

Sent from my SM-G930F using Tapatalk

 

[ColinTaylor]

Isn’t this bad? Someone trying to enter the router?

No. It's probably just a mobile device doing what mobile devices do - periodically trying to connect to hotspots.

 

[RMerlin]

If you don't need the Roaming Assistant then you could disable it to reduce the log spam.

Otherwise, try blacklisting that MAC on the MAC blacklist - it should prevent it from even associating with your router.

The fact it doesn't get an IP indicates it might be associating (at a radio level), but not authenticating (at the network level), therefore it's not getting access to your network. Just annoyingly knocking at your door.