Mystery Device or Router Hacked....

[BJ1200]

We have up to four devices connected to the AC66U at any given time (2-PC's, 1-NAS, 1-Android phone).

Very often I see a 5th device listed in the "Client Status" in the ASUS software. This scares the heck out of me, suspect someone has hacked the router access. Any ideas what the very bottom item might be...or any insight on what to do?

 

[Grievous Angel]

With so few devices (you quote four or five) why not enable MAC filtering?

And what information does it give you when you click the MAC address? I can't rename the host on some of my android devices but when I click the mac address I get manufacturer information (eg, Samsung or LG) that is helpful.

 

[Nerre]

Seems to belong to a NIC from Intel.

Is it connected wireless or cable? (Check the WiFi log under System Log).

I'd suggest changing your WiFi password as a test.

 

[przemek]

the same

Strange, I have similar problem, a few times I had strange MAC addresses on my network and assigned to them IP addresses. Once it was recognized as macbook pro, other was without name)
I am using WPA2 personal, wps disabled, password and network subnets changed.
This happened when I had guest network enabled (maybe with not very complicated WPA2 password but still long).
After disabling guest network it doesnt happened again.
I am new to asus routers, so I could not find any usefull logs to verify that.
It would be usefull event to know to which network IP address is connected (I have 3 passwords: 2,4, 5 ghz, and guest)

 

[cmillar6]

not good, change your wireless password and make it longer. If your guest network is enabled change the password for that as well. I always enable MAC filtering just as an added layer of security.

 

[BJ1200]

I think "Nerre" nailed it. It appears my laptop might be functioning as two devices - the Intel Wireless card, and the Realtek ethernet adapter.

The MAC filter is a good idea, first I heard of it explained....always thought that had something to do with Apple OS. I currently have Guest network disabled and used a WPA random key generator for the very long password.

Thanks everyone. I now need to learn how to find MAC addresses for the devices.

 

[Nerre]

Very often the MAC is on a label on the device.

Under Windows you can see in the Properties for the network adapter (I think it might even show in Status). Under Linux you can see it using ifconfig.

 

[RMerlin]

Very often the MAC is on a label on the device.

Under Windows you can see in the Properties for the network adapter (I think it might even show in Status). Under Linux you can see it using ifconfig.

Under Windows:

ipconfig /all

 

[SCADAMON]

If its a hardwired connection it could be your ISP Modem on the Wan side.

 

[coxhaus]

I agree with Merlin, it is probably just 2 connections from a laptop. The laptop will have a MAC address for the LAN connection and a MAC address for the wireless connection so if you have connected to your network with both a LAN cable and a wireless connection then you will have 2 entries for 2 different MAC addresses. The easy way to find out is to type ipconfig /all on a cmd window on the laptop. Then look for the rogue MAC address.

 

[BJ1200]

Thanks All. I found them using ipconfig - there were actually three MAC addresses associated with the PC. Only two show up in AC66U.

1) Realtek PCIe GBE Controller (ethernet cable)
2) Intel Centrino N-6230 PCI (wireless)
2) Microsoft Virtual Wifi Miniport adapter (turns laptop into wifi hotspot - disabled)

I also found the settings in the router to filter (allow) MAC addresses. However, we are still unable to connect to the NAS with the laptop when using wireless. It connects fine when using ethernet cable. I started another thread on this.

Awesome forum....great participants.

 

[Nerre]

Thanks All. I found them using ipconfig - there were actually three MAC addresses associated with the PC. Only two show up in AC66U.

You PC could have even more. For example if you would use a dial-up connection (old modem or a 3G/4G modem) it would have it's own MAC.

Each network interface (whether physical or "virtual") will have a MAC address.