Cannot identify or block unknown MAC addresses (Part 2)

Question

Previously, I mentioned 5 unknown MAC addresses often connecting to my router, and noticeably causes my internet to be slow.

Router: Tenda D303, Location: India, Connection: BSNL Unlimited 1Mbps broadband.

User drjimbob helped to eliminate other possible causes for slow internet, and here’s my research:

1. “Possibly weak passphrase for Wi-Fi, hence neighbours using it.”

I’ve been using WPA2-PSK authentication, with AES encryption. Tried several complex passphrases for a month now. There are no neighbours other than some close family members, and I have discussed with them this issue.

2. “Interference from neighbours’ routers.”

It’s more like a countryside, more greenery, and less routers in here. I couldn’t find any visible Wi-Fi access points or a router other than mine in my home and vicinity. Also, not many wireless equipment here that could cause interference.

3. “Malware or user-installed software like bittorrent using up bandwidth.”

Couldn’t find any malware on any of my devices, nor any heavy downloading.

4. “ISP’s problem.”

Highly unlikely because when I disable Wi-Fi and use internet via Ethernet from the same router, all works fine, on all PCs.

Now let's set aside the slow internet issue. These 5 MAC addresses, all starting with 00:ff, and titled “DELL” in the DHCP table is what troubles me.

• My research shows a clear correlation between slow internet and presence of these 5.
• I “banned” these 5 under router’s MAC filter, yet they pass through.
• These 5 are not my devices. My 2 DELL laptops appear separately with their own MAC addresses starting with 9c:2a and 64:5a respectively. I even checked all my other devices’ MAC addresses.

Questions:

1. What are these 5 MAC addresses?
2. How do I get rid of them?

The MAC addresses are:

00:ff:93:86:02:04
00:ff:10:ad:b7:82
00:ff:14:97:c9:73
00:ff:eb:72:a3:85
00:ff:f6:cc:8e:f7

Answer 1

Those 5 MAC addresses all are in the 00:FF domain, which are traditionally used for bridged/routed adapters. They aren't assigned to any individual vendor by the IEEE. In this case, you have two possibilities:

1) A malicious actor somehow spoofing MAC addresses on your internal network, or

(much more likely)

2) A computer on your network has some type of virtual (VPN, Virtual Machine, Docker Container, Internet Connection Sharing, etc) adapter(s) which are registering with your router as they show up in the subnet's ARP table. Perhaps traffic generated by those sessions is causing the internet to be slow, as 1MBps can easily be clogged up by streaming or downloading etc.

It's likely the reason that banning them on your router's DHCP table doesn't seem to work is that they don't need DHCP to function -- they're using the host computer's IP address. They're also having traffic routed through that main computer's interface, thus using the main computer's MAC address.

In the end, as others have suggested the only way to conclusively determine what the issue is would be to run a packet capture/trace to see what traffic that MAC address is generating, which might require changing the router with one that supports such inspection.

Reference: Lookup MAC by Vendor - https://regauth.standards.ieee.org/standards-ra-web/pub/view.html#registries

Answer 2

While it wouldn't be fair to rule out a malicious presence, there's a very strong chance that one of your Dell's is registering a virtual connection with the router- thereby creating these DHCP table entries.

Aside from downloading a packet sniffer like Wireshark & digging into the traffic going through your router in an attempt to verify the legitimacy of those entries... I would suggest taking a closer look at each computer's network properties to verify there are no additional adapters other than a wired/wireless connection.

In an attempt to figure out whether or not a singular computer is causing the problem~ try disconnecting one computer from the router, resetting it, & using the other computer to verify the ghost MACs appear again. If they do, use the same process on the other computer.

Hope I've given some ideas as to how to address this.

Answer 3

Regarding interference from other wifi APs please take into consideration wifi APs with hidden SSID running on overlapping channels that can interfere with your.Therefore,try to monitor all wifi access points within range using proper software such as inSSIDer.I would also suggest you consider the following steps;

1. Reset your router to factory settings.
2. configure your router using cable connection.
3. Hide your wifi AP SSID and set strong password.In the wifi settings determine Transmit power of your wifi based on your need.High transmit power means your AP in reachable from farther distance and gives a chance to intruders.
4. I suppose you have a fixed number of devices so it would be better to give each device a static IP for this experiment.Furthermore, determine MAC addresses of your devices and activate MAC filtering.
5. When your devices are all connected check to see if suspicious MAC addresses appear again.
6. If you don't see suspicious MAC addresses anymore, switch to DHCP again but use DHCP Reservations for assigning IP addresses.In some ways this is similar to static IP addressing. How to Set Up DHCP Reservations In addition try limiting your IP pool size to maximum number of devices you think need to be connected to your network.

Answer 4

1. What are these 5 MAC addresses?

Insufficient information to evaluate. Actually unwanted hosts, it's all that you need to know for now.

2. How do I get rid of them?

• Implement a whitelist, so only registered hosts can use your network.
• Create firewall rules to drop these hosts.

If everything fails:

Analyze your network packets using a sniffer and detect what kind of activities these hosts are doing. Attack your own network with Arp Poison or Mac Flood and then analyze all the packets coming from these unwanted hosts. if it's not necessary sniff everything anyway and keep packets for further analysis.

In case of persistence (I doubt) install IPS (virtual machine with bridged connection) and HIDS on your hosts. Analyze some activity logs. If nothing works, maybe your router has a known vulnerability(?).

What happens when you reset your wifi? Are these hosts connecting immediately?

You're probably missing something obvious.

Answer 5

Configure MAC Address filtering which is provided by Tenda-D303. and create a whitelist for all your devices known MAC Addresses.