Rogue device showing up on the network

nwrigley

Senior member
Jun 19, 2005
260
0
76
I have AT&T U-Verse, which provides a 2-wire 3800HGV-B Gateway. This gateway connects over cat5 to my PC, PS3, dvr (1st tv), and set-top-box (2nd tv). It also connects wirelessly to my roommates laptop. Last week, a rogue device showed up on the network (one whose name and MAC address I did not recognize). It was showing up as an "ethernet" device, yet didn't effect the total count of the "local ethernet devices." I reset the device list on the gateway (reassigning DHCP addresses) and the device went away, but came back a few days later.

The device was continually being displayed as active, so I tried to isolate it by turning off the wireless on the gateway and then unplugging ethernet wires one at a time. I got down to just my PC and the device was still there, so I unplugged every device that I could on my PC and still the device persisted. I believe this means that the device is being shown as active in the gateway's network list even when it isn't.

I cleared the device list again and borrowed my roommates laptop the next day to try to duplicate the rogue device appearing. I had her use her remote desktop connection to work, her VPN connection, her Bluetooth PDA, and wired iPod, but nothing showed up on the network. At that point I let it go and nothing else has shown up until today, when a new rouge device (different name and different MAC address) showed up. I asked her if she had been using VPN, remote desktop or anything and she said "no" but that she did get a new external hard drive. Now, I could see external storage showing up on the network, but I doubt it would be with the name "clxbdh-dualcore".

I'm about out of ideas as to what to try now. I'm wondering if someone could somehow be wirelessly connecting directly to her Macbook and showing up on the network that way. Does anyone have any ideas?
 

JackMDS

Elite Member
Super Moderator
Oct 25, 1999
29,514
407
126
If the device has a MAC and IP it has to be a specific network device (most of computer' ad ons device are not network divices.

Switch off the DHCP and assign a static IP to the computers that are using the network and see what happen.

You can try to run this free proggie from your computer, it might be that it would provide more info.

http://www.softperfect.com/products/networkscanner/
 

nwrigley

Senior member
Jun 19, 2005
260
0
76
Originally posted by: JackMDS
Switch off the DHCP and assign a static IP to the computers that are using the network and see what happen.

That's such a simple solution that I completely overlooked it. I've been worrying so much about figuring out how these devices were getting in that I overlooked this practical way of preventing them. I already reset the device list again, so I'll wait for my roommate to connect again before assigning her laptop a permanent address. I suppose I could just configure the DHCP range to be the exact number of devices that I have, but I'm guessing that turning off DHCP altogether is probably more secure. Thanks for the suggestion!
 

nwrigley

Senior member
Jun 19, 2005
260
0
76
Originally posted by: Madwand1
Is your wireless secured with at least WPA?

Yes, it is secured with WPA2. SSID broadcast is turned on because my roommate has issues with connecting when it isn't on (I guess she doesn't check to save the network name in her list). I haven't turned on Wireless MAC Filtering, but the rogue devices don't show up on this list so it would seem to be a mute point.
 

JackMDS

Elite Member
Super Moderator
Oct 25, 1999
29,514
407
126
If you are secured with WPA2, SSID on or off, MAC filter etc. does not matter, because thus far WPA2 is not broken.

As a long shoot.

Depending on how the Wireless part is constructed and configured by the manufacturer, some Wireless Router can appear as two devices with two MAC address. It does not make any functional difference but it can happen.