4

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I wrote down every MAC address, I know.

This device uses the address 10.137.63.254 in an 10.1.0.1/8 network, where the DHCP area is 10.0.3.1/24. The traffic of this IP is very small, my router reports packets of ~74 bytes every ~5 minutes (approximately, I think the interval is random). nmap reports the host as down, but after excessive scanning the IP changed and then returned to the first one.

I figured out that the traffic only appears, when my Win7 laptop is connected to the network. However, I couldn't find any sign of a Cisco NIC. The WLAN and LAN adapters are Intel and MSI NICs. Wireshark doesn't record relevant traffic when listening on the active NIC.

Is there any way to figure out what is going on?

EDIT: The MAC is 00-05-31-F8-C0-65.

EDIT: While playing with the firewall, I couldn't figure out which program was causing this. I have some suspicion, but since the program was really ''shy'', I gave up at some point and reinstalled Windows from a clean backup. Any idea, how to diagnose such problems, is still greatly appreciated.

  • that IP looks like a broadcast IP - when I Google it, I get results like eSight from Huawei. Is this a home or corporate network? – schroeder Apr 28 '16 at 17:13
  • It's a home network. – Stefan Apr 28 '16 at 17:15
  • The traffic pattern is one of a device pinging home. Could you post the MAC? – schroeder Apr 28 '16 at 17:17
  • And eSight and Huawei don't make sense in your network? No VPNs into work, no other connected networks? – schroeder Apr 28 '16 at 17:40
  • What's the other IP this MAC is associated with? Is the laptop in question a work machine? One guess is that your laptop is infected with something that changes your MAC and IP assuming that it's part of a corporate network. It tries pings out on a semi-random schedule, trying to connect to it's control server. – schroeder Apr 28 '16 at 17:43
0

Perhaps try this. Isolate the network to only the laptop and the router producing the statistics in question are connected. If the traffic onf concern is across WIFI, disconnect all network cables. If across wire, shut down WIFI on both devices and watch to see it is not re-enabled.

Run Wireshark with a filter that logs only items that match NEITHER normally expected MAC. Let it run for the duration needed to see the pattern. If you can't figure it out from that, try replacing the NIC and different routers.

  • I wonder if that first statement is true, do you have any data to back that up? As far as I'm aware almost any device allows you to change the MAC address, you just need driver support for it in some cases. – Teun Vink Jan 26 '17 at 10:34
  • If you have an ethernet router (as opposed to DSL) your router will have a MAC for the ISPs router - and it might have an internal / non-routable address. Any chance that Cisco box is actually your routers next hop? – A J Rossington Jan 26 '17 at 11:18
  • @TeunVink, you are correct in your wondering. I've removed the paragraph. Thank you for your gracious and helpful critique. ... I've used hardware where the MAC was on a chip, but that was for banking where hardware encryption was also employed. ... The cards we get in laptops and computer stores have firmware that allow alteration. In LINUX, it can be changed with "ifconfig eth0 hw ether xx:xx:xx:xx:xx:xx" and there is a key in the registry for Windoze. – FauChristian Jan 26 '17 at 15:16
0

It can be a network backdoor inside the NIC. I never saw a Wifi chip of this kind but it definitely exists on ethernet NICs, allowing to sniff traffic (duplicate traffic), send packets, or even hide (route) traffic placing a filter inside the NIC's chip so that the host doesn't even see the incoming/outgoing traffic filtered. This kind of backdoor is generally limited to a few KB / sec in download / upload. But it's enough to receive orders from a hacker and send small amounts of data back.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.