RT-AX86U phantom wired device?

  • ATTENTION! As of November 1, 2020, you are not able to reply to threads 6 months after the thread is opened if there are more than 500 posts in the thread.
    Threads will not be locked, so posts may still be edited by their authors.
    Just start a new thread on the topic to post if you get an error message when trying to reply to a thread.

denpa

New Around Here
I have Merilin 386.3_2 and my router shows (don't know when this started) a phantom wired device. I disconnected all the wires, including to the modem, disabled the VPN, and it still shows up. It has an IP: 172.31.72.174 (my network is based on 192.168.x.x). Checking the IP with IP lookup tools comes up as private/invalid. The MAC address starts with 00:AE; a MAC vendor lookup doesn't bring anything.

Any ideas what this may be? or what kind of troubleshooting I can do to find out I blocked its Internet access just to be sure.
 

Wallace_n_Gromit

Senior Member
I have Merilin 386.3_2 and my router shows (don't know when this started) a phantom wired device. I disconnected all the wires, including to the modem, disabled the VPN, and it still shows up. It has an IP: 172.31.72.174 (my network is based on 192.168.x.x). Checking the IP with IP lookup tools comes up as private/invalid. The MAC address starts with 00:AE; a MAC vendor lookup doesn't bring anything.

Any ideas what this may be? or what kind of troubleshooting I can do to find out I blocked its Internet access just to be sure.
You might try doing a search for "phantom device" or "unknown mac address" using the [Better Search] feature of the site at the top of the page.

The vendor ID portion of the MAC address starts with the first three and not just the first two in the sextet.

Try taking a snapshot of the page in the Asus GUI where you are seeing this device and post it here. Might help us troubleshoot it more quickly.

Was it listed in the WAN interface? Have you ruled out the ISP's Server device's MAC address?
 

denpa

New Around Here
When I tried a Google search, I didn't get something meaningful. I see some posts here about virtual adapters and randomized cell phone MACs but it doesn't seem to be the case here.

I did search using the whole MAC address, I didn't know if it was a good idea to post the full MAC (here are more digits: 00:AE:47:AD:x:x).

It shows up in the "clients" list.
Screen Shot 2021-09-12 at 8.50.41 AM.png

I renamed the device to "Unknown???" and blocked its Internet traffic. I tired to force another IP address to it, but it wouldn't take,


My ISP' server's modem has a different MAC, plus I disconnected ALL wires (including going to the modem) and it will still appear there.
 

Wallace_n_Gromit

Senior Member
I did search using the whole MAC address, I didn't know if it was a good idea to post the full MAC (here are more digits: 00:AE:47:AD:x:x).~

~ My ISP' server's modem has a different MAC, plus I disconnected ALL wires (including going to the modem) and it will still appear there.
Yes, not a good idea to show all 6, just the first three. 00:AE:47:xx:xx:xx

My experience with a "phantom device" ended up being (not the Modem in your house) the MAC/IP address of the ISP's remote Gateway device which my home modem connected to and showed up in my WAN interface.

Is your router a brand new device, or was it bought used? (I wonder if a Factory default Restore w/ "Initialize all the settings..." checked would resolve this issue) That is a typical "best practices" (<-- Click on it for URL) anyway when you upgrade your default AsusWRT firmware to Merlin's version.
 
Last edited:

denpa

New Around Here
Thanks. It seems to be gone now, I think it was due to a SoftEther server running on one of my wired devices. However, it will still show when the device was disconnected and shut off. It took a reboot of the router to stop showing the device, even a refresh of the client list wouldn't do it.
Question: how do I force a hard client list reset/refresh, aside from a router reboot? That threw me off in my troubleshooting since the device kept showing in the list between manual and automatic refreshes (it would occasionally disappear for a second but would come right back). Again, this is for wired clients.

FYI I removed SoftEther anyway since I now use the router's build in VPN server.
 

Wallace_n_Gromit

Senior Member

Attachments

  • InkedScreenshot 2021-09-12 at 10-06-44 ASUS Wireless Router RT-AC86U - Network Map_LI.jpg
    InkedScreenshot 2021-09-12 at 10-06-44 ASUS Wireless Router RT-AC86U - Network Map_LI.jpg
    306.6 KB · Views: 36

BobD

Regular Contributor
I've had that problem several times of late on my Merlin RT-AX86u. It's always a wired ethernet and the address is sometimes within my defined DHCP range of 10.x.x.x. Today's event showed a 169.x.x.x address. I used to also get it on my RT-AC86U with ASUS firmware. Usually a reboot of the router clears the problem. I got very excited about it first time it happened. Somebody invading the network etc. but now I just reboot if it bothers me enough.
 

willyburz

Regular Contributor
I have directv genie, and the two satellite boxes show wired in my connected menu. Not a big deal, I just label all my connections and cross check with their ip.
 

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top