Unknown MAC address uploading lots of data

[bobo27]

Hi all,

since a few days I see on the traffic monitoring tab that an unknown MAC address is uploading (nothing down) lots of data, see the screenshot. This MAC address doesn't show in my network list, nor on my managed switch. I have tried to MAC-filter it it so it would stop sending data but that also doesn't stop it from sending data. My modem has a different MAC address.. Have checked all known devices but still nothing..

Does anyone know what this could be?

Any help much appreciated.

 

[skeal]

Hi all,

since a few days I see on the traffic monitoring tab that an unknown MAC address is uploading (nothing down) lots of data, see the screenshot. This MAC address doesn't show in my network list, nor on my managed switch. I have tried to MAC-filter it it so it would stop sending data but that also doesn't stop it from sending data. My modem has a different MAC address.. Have checked all known devices but still nothing..
View attachment 18512
Does anyone know what this could be?

Any help much appreciated.

What model router?

 

[bobo27]

It's an AC-86U with Merlin 384.12 on it

 

[skeal]

It's an AC-86U with Merlin 384.12 on it

I looked it up on google to see if I could get a vendor name this is what I found:

object(stdClass)#1 (4) { ["assignment"]=> string(6) "001710" ["organization_address"]=> string(56) "10, New England Business Center Dr. Andover MA US 01810 " ["organization_name"]=> string(17) "Casa Systems Inc." ["registry"]=> string(4) "MA-L" }

 

[skeal]

I looked it up on google to see if I could get a vendor name this is what I found:

object(stdClass)#1 (4) { ["assignment"]=> string(6) "001710" ["organization_address"]=> string(56) "10, New England Business Center Dr. Andover MA US 01810 " ["organization_name"]=> string(17) "Casa Systems Inc." ["registry"]=> string(4) "MA-L" }

Casa Systems Inc. seems to be the vendor, some kind of telecommunications outfit.

 

[bobo27]

I looked it up on google to see if I could get a vendor name this is what I found:

object(stdClass)#1 (4) { ["assignment"]=> string(6) "001710" ["organization_address"]=> string(56) "10, New England Business Center Dr. Andover MA US 01810 " ["organization_name"]=> string(17) "Casa Systems Inc." ["registry"]=> string(4) "MA-L" }

Yes thanks, I had found that too but I couldn't find what devices they make so I can check what I have. It doesn't ring a bell. It also does iTunes and iMessage.. weird

 

[skeal]

It's an AC-86U with Merlin 384.12 on it

Casa Systems Inc
Casa Systems, Inc. provides telecommunication equipment and solutions. The Company offers cable, modem, optical, and Wi-Fi networking products. Casa Systems also provides software-centric infrastructure solutions that allow cable service providers to deliver voice, video, and data services over a single platform. Casa Systems operates worldwide.

 

[bobo27]

Casa Systems Inc
Casa Systems, Inc. provides telecommunication equipment and solutions. The Company offers cable, modem, optical, and Wi-Fi networking products. Casa Systems also provides software-centric infrastructure solutions that allow cable service providers to deliver voice, video, and data services over a single platform. Casa Systems operates worldwide.

Thanks, that helps a bit. What direction is the upload in the menu? Is that from the device to internet or from the router to the device?

 

[skeal]

Thanks, that helps a bit. What direction is the upload in the menu? Is that from the device to internet or from the router to the device?

Is anything connected through VPN?

 

[bobo27]

Is anything connected through VPN?

Yes, I sometimes use my openvpn server on the router to connect to my LAN when I'm away. But I'm at home now, and it just did about 800 MB...

 

[skeal]

Yes, I sometimes use my openvpn server on the router to connect to my LAN when I'm away. But I'm at home now, and it just did about 800 MB...

Any download traffic through a VPN will show up as upload traffic in the traffic stats.

 

[skeal]

Asus has had this issue for as long as I have been a member here at least.

 

[bobo27]

Thanks, that helps a bit. What direction is the upload in the menu? Is that from the device to internet or from the router to the device?

My router is connected to a modem from my cable provider. Sometimes they update the firmware remotely, and then it is no longer just a modem but a router too. It does have a completely different MAC address written on it though. It can then also be used by subscribers of the same provider to log on to a wifi network. But that traffic should not go through my router.

 

[skeal]

My router is connected to a modem from my cable provider. Sometimes they update the firmware remotely, and then it is no longer just a modem but a router too. It does have a completely different MAC address written on it though. It can then also be used by subscribers of the same provider to log on to a wifi network. But that traffic should not go through my router.

I'm pretty sure your modem is the device. Modems and routers have a variety of mac addresses to define each network component like bridges and switches and the like.

 

[bobo27]

I'm pretty sure your modem is the device. Modems and routers have a variety of mac addresses to define each network component like bridges and switches and the like.

Thanks, I'll dig into the modem and see what I find there.

Just one last question: upload in the overview means from the router to device, right?

 

[skeal]

Just one last question: upload in the overview means from the router to device, right?

No, from device to outside world I believe is upload traffic in the stats, thus the reversal with VPN traffic.

 

[RMerlin]

If I remember, Casa manufactures DOCSIS endpoints. This is probably your ISP.

 

[Datalink]

If you happen to be located in Canada, and connected to the Rogers network, either directly or thru a TPIA, then you're modem is most likely connected to a CASA Cable Modem Termination System (CMTS). Rogers started replacing their Cisco CMTS equipment with CASA CMTS equipment around late 2015 / early 2016. By now, I'd expect all of Rogers CMTS equipment to be CASA produced.

 

[RMerlin]

If you happen to be located in Canada, and connected to the Rogers network, either directly or thru a TPIA, then you're modem is most likely connected to a CASA Cable Modem Termination System (CMTS). Rogers started replacing their Cisco CMTS equipment with CASA CMTS equipment around late 2015 / early 2016. By now, I'd expect all of Rogers CMTS equipment to be CASA produced.

Same with Videotron here in Quebec.

Sent from my P027 using Tapatalk