Manually DHCP List and Domain Name Showing Unremovable Items

[kidd232]

I used WireGuard to connect two routers, RT-AX86U & GT-AX6600 running newest merlin firmware, and everything was working fine. However, over the past few days I noticed something strange:

．In both routers, the manual DHCP list and the domain name field started showing unusual entries that I cannot remove.

．In the Domain Name setting, asus.com keeps appearing. Even if I change it to another word or clear it completely, after clicking Apply it always reverts back to asus.com.

．In the DHCP list, three strange entries related to ASUS keep showing up. Just like the domain name issue, if I edit or delete them, they reappear shortly after. What’s odd is that these entries are on a different subnet — I’m not using the 192.168.1.0 network at all.

Does anyone know why this is happening?

 

[ColinTaylor]

What is the exact firmware version? "newest" could mean the current release version or latest beta version.

What scripts are you running on these routers, if any?

If you have JFFS custom scripts and configs enabled (Administration - System) I would temporarily disable that, reboot the router and see if the entries disappear.

You say these two routers are connected using WireGuard. The GT-AX6000's subnet is 192.168.0.0/24. What is the subnet of the RT-AX86U? They should be different if this is a LAN to LAN setup.

 

[dave14305]

To be cynical, I’d speculate some malware on the router wants to sinkhole any Asus update mechanism by redirecting the names to a local IP.

 

[ColinTaylor]

To be cynical, I’d speculate some malware on the router wants to sinkhole any Asus update mechanism by redirecting the names to a local IP.

I was thinking along the same lines (although there would be less obvious ways of achieving the same thing). Especially as his previous posts indicate that he was using AiCloud.

 

[kidd232]

What is the exact firmware version? "newest" could mean the current release version or latest beta version.

What scripts are you running on these routers, if any?

If you have JFFS custom scripts and configs enabled (Administration - System) I would temporarily disable that, reboot the router and see if the entries disappear.

You say these two routers are connected using WireGuard. The GT-AX6000's subnet is 192.168.0.0/24. What is the subnet of the RT-AX86U? They should be different if this is a LAN to LAN setup.

GT-AX6600: 3006_102.5_0, subnet: 192.168.0.0/24
RT-AX86U: 3004_388.9_2, subnet: 192.168.2.0/24

These two routers only have Skynet and Scribe installed via amtm.
I tried disabling JFFS custom scripts and configs, but the issue remains.

It seems like this is abnormal behavior, so I’ll need to do a reset.

 

[Poul Bak]

Do you use DDNS? That might explain the 'asus.com' thing.

Try checking the mac addresses here: https://maclookup.app/

Anyway, I would definitely do a factory reset.