Bumped by Community user
    Tweeted twitter.com/StackSecurity/status/788515407577620480
4 moved comment to question
source | link

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I wrote down every MAC address, I know.

This device uses the address 10.137.63.254 in an 10.1.0.1/8 network, where the DHCP area is 10.0.3.1/24. The traffic of this IP is very small, my router reports packets of ~74 bytes every ~5 minutes (approximately, I think the interval is random). nmap reports the host as down, but after excessive scanning the IP changed and then returned to the first one.

I figured out that the traffic only appears, when my Win7 laptop is connected to the network. However, I couldn't find any sign of a Cisco NIC. The WLAN and LAN adapters are Intel and MSI NICs. Wireshark doesn't record relevant traffic when listening on the active NIC.

Is there any way to figure out what is going on?

EDIT: The MAC is 00-05-31-F8-C0-65.

EDIT: While playing with the firewall, I couldn't figure out which program was causing this. I have some suspicion, but since the program was really ''shy'', I gave up at some point and reinstalled Windows from a clean backup. Any idea, how to diagnose such problems, is still greatly appreciated.

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I wrote down every MAC address, I know.

This device uses the address 10.137.63.254 in an 10.1.0.1/8 network, where the DHCP area is 10.0.3.1/24. The traffic of this IP is very small, my router reports packets of ~74 bytes every ~5 minutes (approximately, I think the interval is random). nmap reports the host as down, but after excessive scanning the IP changed and then returned to the first one.

I figured out that the traffic only appears, when my Win7 laptop is connected to the network. However, I couldn't find any sign of a Cisco NIC. The WLAN and LAN adapters are Intel and MSI NICs. Wireshark doesn't record relevant traffic when listening on the active NIC.

Is there any way to figure out what is going on?

EDIT: The MAC is 00-05-31-F8-C0-65.

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I wrote down every MAC address, I know.

This device uses the address 10.137.63.254 in an 10.1.0.1/8 network, where the DHCP area is 10.0.3.1/24. The traffic of this IP is very small, my router reports packets of ~74 bytes every ~5 minutes (approximately, I think the interval is random). nmap reports the host as down, but after excessive scanning the IP changed and then returned to the first one.

I figured out that the traffic only appears, when my Win7 laptop is connected to the network. However, I couldn't find any sign of a Cisco NIC. The WLAN and LAN adapters are Intel and MSI NICs. Wireshark doesn't record relevant traffic when listening on the active NIC.

Is there any way to figure out what is going on?

EDIT: The MAC is 00-05-31-F8-C0-65.

EDIT: While playing with the firewall, I couldn't figure out which program was causing this. I have some suspicion, but since the program was really ''shy'', I gave up at some point and reinstalled Windows from a clean backup. Any idea, how to diagnose such problems, is still greatly appreciated.

3 added MAC
source | link

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I wrote down every MAC address, I know.

This device uses the address 10.137.63.254 in an 10.1.0.1/8 network, where the DHCP area is 10.0.3.1/24. The traffic of this IP is very small, my router reports packets of ~74 bytes every ~5 minutes (approximately, I think the interval is random). nmap reports the host as down, but after excessive scanning the IP changed and then returned to the first one.

I figured out that the traffic only appears, when my Win7 laptop is connected to the network. However, I couldn't find any sign of a Cisco NIC. The WLAN and LAN adapters are Intel and MSI NICs. Wireshark doesn't record relevant traffic when listening on the active NIC.

Is there any way to figure out what is going on?

EDIT: The MAC is 00-05-31-F8-C0-65.

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I wrote down every MAC address, I know.

This device uses the address 10.137.63.254 in an 10.1.0.1/8 network, where the DHCP area is 10.0.3.1/24. The traffic of this IP is very small, my router reports packets of ~74 bytes every ~5 minutes (approximately, I think the interval is random). nmap reports the host as down, but after excessive scanning the IP changed and then returned to the first one.

I figured out that the traffic only appears, when my Win7 laptop is connected to the network. However, I couldn't find any sign of a Cisco NIC. The WLAN and LAN adapters are Intel and MSI NICs. Wireshark doesn't record relevant traffic when listening on the active NIC.

Is there any way to figure out what is going on?

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I wrote down every MAC address, I know.

This device uses the address 10.137.63.254 in an 10.1.0.1/8 network, where the DHCP area is 10.0.3.1/24. The traffic of this IP is very small, my router reports packets of ~74 bytes every ~5 minutes (approximately, I think the interval is random). nmap reports the host as down, but after excessive scanning the IP changed and then returned to the first one.

I figured out that the traffic only appears, when my Win7 laptop is connected to the network. However, I couldn't find any sign of a Cisco NIC. The WLAN and LAN adapters are Intel and MSI NICs. Wireshark doesn't record relevant traffic when listening on the active NIC.

Is there any way to figure out what is going on?

EDIT: The MAC is 00-05-31-F8-C0-65.

2 deleted 27 characters in body
source | link

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The often suggested OUI lookup yields CISCOCisco as manufacturer. However, I don't have such a device in my network -- actually, I wrote down every MAC address, I know.

This device uses the adressaddress 10.137.63.254 in an 10.1.0.1/8 network, where the DHCP area is 10.0.3.1/24. The traffic of this IP is very small, my router reports packets of ~74 bytes every ~5 minutes (approximately, I think the interval is random). nmap reports the host as down, but after excessive scanning the IP changed and then returned to the first one.

I figured out that the traffic only appears, when my Win7-Laptop laptop is connected to the network. However, I couldn't find any sign of a Cisco NIC on this laptop. The WLAN and LAN adapters are Intel and MSI NICs. Wireshark doesn't record relevant traffic, when listening on the active NIC.

Is there any way, to figure out what is going on?

A few days ago, I noticed an unknown MAC address in the statistics page of my router. The often suggested OUI lookup yields CISCO as manufacturer. However, I don't have such a device in my network -- actually, I wrote down every MAC address, I know.

This device uses the adress 10.137.63.254 in an 10.1.0.1/8 network, where the DHCP area is 10.0.3.1/24. The traffic of this IP is very small, my router reports packets of ~74 bytes every ~5 minutes (approximately, I think the interval is random). nmap reports the host as down, but after excessive scanning the IP changed and then returned to the first one.

I figured out that the traffic only appears, when my Win7-Laptop is connected to the network. However, I couldn't find any sign of a Cisco NIC on this laptop. The WLAN and LAN adapters are Intel and MSI NICs. Wireshark doesn't record relevant traffic, when listening on the active NIC.

Is there any way, to figure out what is going on?

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I wrote down every MAC address, I know.

This device uses the address 10.137.63.254 in an 10.1.0.1/8 network, where the DHCP area is 10.0.3.1/24. The traffic of this IP is very small, my router reports packets of ~74 bytes every ~5 minutes (approximately, I think the interval is random). nmap reports the host as down, but after excessive scanning the IP changed and then returned to the first one.

I figured out that the traffic only appears, when my Win7 laptop is connected to the network. However, I couldn't find any sign of a Cisco NIC. The WLAN and LAN adapters are Intel and MSI NICs. Wireshark doesn't record relevant traffic when listening on the active NIC.

Is there any way to figure out what is going on?

1
source | link