Network discovery? Unknown devices found on network

Status
Not open for further replies.

mikehhh

Distinguished
May 5, 2010
6
0
18,510
I keep noticing various phones / generic devices visible on my network, who haven't been assigned IP addresses.

Here is a pic to illustrate -
http://oi60.tinypic.com/1035v8o.jpg

I don't know whose device QMobile is, but all of the other devices are accounted for, and QMobile at least hasn't been assigned an IP address, but it's still slightly disconcerting. Is this a security risk or an artefact of network discovery?

many thanks
 
Solution
Make sure WPS mode is disabled. You can crack the WPS pin code and it is impossible to change it and this code will give the user the WPA2 key.

It still takes like 10 hours to initially crack the WPS pin so it is not something that someone would just randomly do, it take quite a effort to break in.

Still it is always good policy to disable this feature. If we could get rid of all the stupid people maybe the router manufactures would stop shipping routers with this enabled out of the box.
If it was on the network, at one point in time it had an IP address.

Some devices show up as some weird generic thing on your Windows Device list, it could be completely nothing, and is some device you hooked up some time ago.

Just to be safe I would change your wifi password and make sure you are set on WPA2
 

mikehhh

Distinguished
May 5, 2010
6
0
18,510
I was worried you might say that. They definitely aren't old devices that should have connected, if that's what happened. The question is if they had access, and knew it.

I have switched from WPA/WPA2-PSK mixed to WPA2 only and changed the key, we'll see if that does the trick. I have a feeling there'll still be devices floating around, will report back.
 

mikehhh

Distinguished
May 5, 2010
6
0
18,510
New network key, WPA2 only encryption... still finding random devices. Now a HUAWEI P7-L10.

I'm not in a busy enough location for these all to be people hacking into the network, is there any chance Windows just displaying anything that is broadcasting/searching for a broadcasting access point?

edit: Also the devices often disappear when I hit refresh
 
Make sure WPS mode is disabled. You can crack the WPS pin code and it is impossible to change it and this code will give the user the WPA2 key.

It still takes like 10 hours to initially crack the WPS pin so it is not something that someone would just randomly do, it take quite a effort to break in.

Still it is always good policy to disable this feature. If we could get rid of all the stupid people maybe the router manufactures would stop shipping routers with this enabled out of the box.
 
Solution

mikehhh

Distinguished
May 5, 2010
6
0
18,510
Ahh thanks for that, sorry for late reply, didn't get an email notification. Sure enough I disabled WPS yesterday and have been periodically checking the network from a couple of machines - no unwanted devices!
 

sadena

Distinguished
Apr 22, 2011
67
0
18,630
I want to add my own experience, because the explanation is completely other than one would expect.

I set up a new, more advanced Linksys Router (EA6300) and I started seeing this unknown Android device, many instances of it with the same device name but different (but similar) MAC addresses. And sometimes the router indicated it was on the WLAN, other times on the LAN (which was impossible). The MAC address varried but the first half was the same (00:E0:4C:*:*:*).

So, I'm thinking it is either a glitch, or some bizarre hacker using multiple sophisticated techniques to hack into my network for no very good reason.

I started by banning the MAC addresses, but as it kept changing, that was pointless. So then I set up an exclusive MAC allowed list (which is one of those things you snobs say is pointless to do).

The unknown Android device stopped showing up... but then I noticed... my tablet stopped connecting.

It was my tablet! The freaking thing generates a new MAC address every time you reboot it! WHY?! Why would this be an intentional feature?! It wouldn't help with anything... although in a way it would make for good anonymous network use. But it just seems absurd! Could it be a glitch? This is a no-name tablet (ematic), but that's a hell of a glitch, but also a hell of a strange feature!
 

ricajax

Commendable
Oct 12, 2016
4
0
1,510


 

ricajax

Commendable
Oct 12, 2016
4
0
1,510


 

ricajax

Commendable
Oct 12, 2016
4
0
1,510


 

rjphoto

Commendable
Dec 22, 2016
2
0
1,510


 

rjphoto

Commendable
Dec 22, 2016
2
0
1,510
I have the same issue. I need to know safe or not. I have changed my wireless security password, wpa, reset modem to factory, clean install on my window 10 machines. I see devices that I do not own, they have not had IP addresses per DHCP reservations. I see the manufacturer and MAC address. Randomly appear and if I click on them they disappear for a while. They are not some device that I own - phone called angler and shamu and a Linux box (and if this is you pls tell me how you do it then stay off my network)
I see them File explorer>network but not by looking on router. I have one wireless printer and disconnect all other devices like blue-ray player that links to internet.
I was told by help desk from antivirus/firewall provider to turn off network discovery and will solve my problem but I think it doesn't solve it but I don't see it (which may be OK). Which I think may be correct if I was on public network like at university but I question the answer on small home network.
None of the solutions listed in post fix or fit my network.
suggestions?
 

USAFRet

Titan
Moderator


1. Please don't glom onto a very old thread.

2. Please provide some links or references to back up your assertions.

3. It is "solved", in relation to the original post and question.
 
Status
Not open for further replies.