Can some Identify this for me please?

[richyrich]

Hi all, anyone know what the second entry might be, the top is Google chromecast.

It's Xerox with a mac address of all zeros.

Any help would be great, thanks.

 

[ColinTaylor]

I suspect the MAC address is bogus and it's not really a Xerox device (Xerox owns the MAC addresses starting at 0).

It's probably a badly made IoT device somewhere (wireless headset, etc). Judging by the signal strength it looks close by, maybe it's the chromecast. Try turning things off to identify it.

 

[richyrich]

I suspect the MAC address is bogus and it's not really a Xerox device (Xerox owns the MAC addresses starting at 0).

It's probably a badly made IoT device somewhere (wireless headset, etc). Judging by the signal strength it looks close by, maybe it's the chromecast. Try turning things off to identify it.

Will do. Thanks a lot for your help. Much appreciated.

 

[richyrich]

Had time to check and think it was tp-link device. Have a weird mac address showing now. Anyone have any idea what the top one maybe.

 

[joegreat]

May I google it for you?
The first result in the list is the answer...

As the device is far away -87 dBm - it could be a neighbor's Alexa!?

 

[richyrich]

May I google it for you?
The first result in the list is the answer...

As the device is far away -87 dBm - it could be a neighbor's Alexa!?

I did google the whole mac address...my bad. Cheers for your help!

 

[ColinTaylor]

May I google it for you?
The first result in the list is the answer...

Alas, no. Google changed your search from 72:75:48 to 74:75:48. There is no vendor associated with 72:75:48.

@richyrich You said you think it's a tp-link device, why do you say that?

 

[RMerlin]

https://www.wireshark.org/tools/oui-lookup.html

 

[richyrich]

Alas, no. Google changed your search from 72:75:48 to 74:75:48. There is no vendor associated with 72:75:48.

@richyrich You said you think it's a tp-link device, why do you say that?

Hi Colin, I thought the first one was a tp link device because when I turned it off it disappeared.
That mac address got me baffled though.
Think my router has been cloned.
Is that possible?

Also when I ping the first hop is 102ms but the others are only 12ms?

@Merlin wireshark does not recognise that Mac address?

 

[ColinTaylor]

Hi Colin, I thought the first one was a tp link device because when I turned it off it disappeared.
That mac address got me baffled though.

Well it sounds like the tp-link then. Is the tp-link a repeater? I've heard of repeaters that create fake MAC addresses for their clients.

 

[richyrich]

I'm using it in client mode for a sky set top box to get on demand. This one: http://uk.tp-link.com/products/details/cat-9_TL-WR902AC.html

I have it connected WPA2 though, so where the wep is coming from I don't know?

Thanks for your help Colin, much appreciated.

 

[Jack Yaz]

Am I missing something? That looks like a list of the WiFi networks nearby, rather than connected devices.

 

[richyrich]

Am I missing something? That looks like a list of the WiFi networks nearby, rather than connected devices.

The Xerox one baffled me a bit because it was so strong and my neighbours are 20 meters away but yeah, like you say they are nearby networks.