Unknown Client appears in Wireless node in Router. Confused

Question

I hope that I am addressing this question in the correct place.

I have a bit of a conundrum ...

At my home place I have a Router that is using the dd-wrt software. Only clients I use are a game console on LAN, a laptop (operating Win 7 x64) on wifi and my phone on wifi.

As of lately, in the Status / Wireless / Wireless Nodes I see a client (with the following MAC address 00:11:F7:ED:70:14 ) being allocated one of the IPs of the router, but I do not know who that is. Its neither of my devices that have a preallocated IP address.

I have changed the password to the Wifi, rebooted, unplugged and restarted the router, and now I see that the same client still appears in the list, albeit now it tends to disappear at times if I refresh the page. But then it quickly reappears.

If I do a IP search with various IP finder software, at that particular IP I don't find anything. If I do a ping to that IP I get a "destination host unreachable".

How can I solve this issue? I do not have that much of a technological grasp on networking concepts, but I hope that with your help, I can manage to reach a solution?

Thank you very much!

Solution

A media access control (MAC) address can be used to identify the manufacturer of a device, or at least the manufacturer of the network interface controller (NIC) for the device, which may help you to track down the device, since the first 3 groups of hexadecimal digits, i.e., the first 6 digits, in the MAC address identify the manufacturer. In your example, that is 00:11:F7. The next 3 groups of hexadecimal digits are assigned by the manufacturer to a particular device and can be viewed as similar to a serial number a manufacturer might assign to a device. There are many sites on the web that will allow you to look up the manufacturer from a MAC address. E.g. MAC Address and OUI Lookup, which shows the manufacturer for 00:11:F7 is Shenzhen Forward Industry Co., Ltd.

According to ShenZhen Forward Industry Co.,Ltd:

Shenzhen Forward Industry Co., Ltd. is one of the first companies specializing in the development and production of paging equipment in China. It is a large-scale operation for radio paging transmitter equipment. Since our establishment, we have gained the trust and satisfaction of over 1,000 customers in over 30 provinces and cities in southeast Asia.

00:11:F7 lan address devices has a link to a company profile at Shenzhen Forward Video Technology Co., Ltd., which indicates the company's products include the following equipment:

HDMI Video Capture,USB Video Capture,Audio Cassette Converter,USB TV Receiver,Video Converter

Comments

[SDsolar]

Are you sure it isn't a smartphone?

[Lucian Viorel]

Thank you for answering! There is nothing else I own. I have exactly one phone, and I can see it in the list when I activate the wifi. Can it be an unidentified user trying to connect to the router? If yes, then why do I see it even after I change the password to the wifi? It connects instantly.

[Richard]

I had random devices appearing in Windows "Network", changed the WiFi password and still they appeared. It turned out to be an issue with uPnP and disabling that capability on the router caused them to disappear.

[SDsolar]

Ah, yes. Concur. Make darn sure uPnP is shut off. You can also take the uPnP vulnerability test at grc.com

[quadruplebucky]

Are you sure it's actually connecting (that is, associating, authenticating, requestiing a DHCP lease, and being granted one)...I ask because on my dd-wrt that page does not report DHCP leases or anything to do with IP addresses, it reports MAC associations with the router's radio, not communications with the actual IP network stack (may sound like hairsplitting, ,but hey, it's made of hairs...) I suspect it's a cheap wifi camera making friends with all the wifi in the neighborhood. 299 days uptime on my dd-wrt and it has lots of friends who've sent no traffic.

[Lucian Viorel]

Thank you all for your tips! I am not sure @quadruplebucky , but I see it in Status / Wireless / Wireless Nodes and in Status / Lan / Active Clients. Which is odd, because it also appeared when I changed the password to the wifi. Like it didnt even matter. It does not appear in the Status / Lan / DHCP Clients List, however. I'll try to check the uPnP protocol status too.

[Lucian Viorel]

Thank you very much! I guess this solves the issue. I tried going for the MAC address, but I didnt manage to find anything for 00:11:F7. Not sure what video capture device this is, that accesses my wifi, but at least its an explanation as to what it is.

[SDsolar]

Could be a smart TV...

[Lucian Viorel]

I found out what it is. Its a Wifi Module for an Air Conditioner that I tried once to connect to my Router Wifi, but failed to connect. Thank you all!