[SOLVED] mystery device on network

[Altus]

I found a mystery device on our network, which I don't think belongs to us.I will really appreciate your help !

1. The MAC address shows that the device is manufactured by Compal International which is a company manufacture Laptops, phone for Dell,Amazon and ect.

https://www.compal.com/

1. The Hostname is Amazon xxxxx, I don't have any amazon product, no kindle, no amazon echo.
2. It show up sometimes, no regular schedule
3. I see it on connected device on router, but not on network scan apps such as Fing
4. It doesn't response Ping
5. I ran nmap scan, it shows the host is down. the only service (netbios-ssn and Microsoft -ds) are closed
6. I ran wiresharck scan, no traffic or related item found filtered by the device's IP.

A. what do you think it might be? or what is the cause of this problem?
B. Is this anything that I should worry about? like a network attack or spy device?
Thank you again!!

 

[kanewolf]

This may be a device that attempts to connect to your secured network, fails to authenticate but remains in the list of visible devices on the router. This may be a false positive indicator from the router. Since it doesn't show up in Fing, it doesn't have an IP address.

 

[bill001g]

Pretty much the only way a device can get on your network is via wireless. Good wireless security practice makes it almost impossible for unauthorized people to get on. The only know exposure is called WPS and unfortunately router manufacture have it enabled by default because it is used by all the lazy stupid people in the world.

It still is extremely unlikely someone used it to bypass the security but to be sure disable WPS and change your wifi password. If you have not changed the SSID to be something not common that will help with random machines attempting and failing to connect. Used to be when the default ssid was something like linksys phones would attempt to connect any time they saw any router with that ssid. They would of course fail but it still caused lots of unneeded attempts.

 

[Altus]

This may be a device that attempts to connect to your secured network, fails to authenticate but remains in the list of visible devices on the router. This may be a false positive indicator from the router. Since it doesn't show up in Fing, it doesn't have an IP address.

Thanks kanewolf, it is really helpful. The only thing is it has a IP address and it is on connected device on router.

 

[kanewolf]

Thanks kanewolf, it is really helpful. The only thing is it has a IP address and it is on connected device on router.

I thought you said it didn't show up in FING, which would say it doesn't have an IP address ...

As @bill001g said, ensure that WPS is DISABLED on your router and that you have a strong password.
Is it possible someone else in the house has a guest that has a fire tablet or other amazon device?

 

[Altus]

I thought you said it didn't show up in FING, which would say it doesn't have an IP address ...

As @bill001g said, ensure that WPS is DISABLED on your router and that you have a strong password.
Is it possible someone else in the house has a guest that has a fire tablet or other amazon device?

Thanks,

I tried to disconnect every electronic device, didn't find anything though. Also, I am guessing if is a amazon device, the mac address would suggest the vendor is Amazon.

 

[bill001g]

This has to be possible to find. First disable the wifi completely and unplug everything except 1 pc. At this point you better not see anything other than the pc you have plugged in. Now plug in the ethernet cables 1 by 1 and see if it shows up. You need to follow the cable if you see a device.
The change the password again on your wifi and be sure WPS is disabled. Now start go device by device changing the wifi password on each. If it is anything that is your equipment it will show up as you connect it. Pretty much if you get a unauthorized wifi device someone in your house told someone the new password.