Random new devices appearing on the LAN network

Software SW help
,
1

Hello,
I have notifications for new devices on the network and today it started acting, but nothing is changing on my network so it got me a little worried. It’s on the internal 192.168.0.0 network and I don’t know where it’s coming from.

Just today I got 4 emails for 5 devices (+1 yesterday) added and it’s not from wireless.

If I go to Active DHCP leases I see some new strange MAC addresses (I have all my devices labeled with hostname)
image

I can even ping one of the IPs and response time would appear to be from remote location. Any idea what the hell is going on here?
image

2

Some Xiaomi devices, perhaps:

The third is perhaps less helpful (to me at first glance at least):

Of course, MAC addresses are easy to spoof, but perhaps these are not.

3

i think some android phones have the “privacy” option to use random MAC when connected to a network that doesn’t have this option off.

  • check phones in your network.

I’d prefer to put those into the guest network, and shape the guest network so random devices don’t eat all bandwidth.

4

Android since version 10 and IOS (Apple) since version 14 use “Random MAC addresses”, but these addresses remains the same on the same network (SSID).
And you can disable these random addresses on your home network in Wi-Fi setting of your device.

5

I’m pretty sure it’s not wireless. Private wireless is strong-passworded and MAC-filtered. If it was on a guest network it would assign IP from a different range (and warn about new device on a guest network) not to mention it would be visible in Associated Stations under Wireless in LUCI. For years LAN network is hardened and has only devices I know about and out of the sudden on one day it starts connecting randoms with high ping.

I’ve opted to upgrading firmware on a modem and reflashed the Turris and for 24-hours it’s been clean.

6

wlan devices are logged in syslog this way:

Jan 6 11:46:15 turris hostapd: wlan1: STA 30:3a:64:xx:xx:xx IEEE 802.11: authenticated

Jan 6 11:46:16 turris dev-detect-daemon[6219]: INFO: New device detected on interface ‘br-lan’. MAC: 30:3a:64:xx:xx:xx | IPv6 address: fe80::*

7

luci can easily tell you which devices are associated via wireless so that’s easy to determine. You can also turn wireless off temporarily. But I can’t see how devices could turn up on the lan without being linked to any interface? Do you have the default zone settings on the firewall, or have you made changes?

8

Also you can run some scans using nmap from any machine on the same network as those new devices…