16

I found an unknown MAC address connected to my home router. How would I figure out what OS the IP or MAC address is running?

Improve this question
3
  • 3
    I'm not sure this is an IT Security question. Could you add more details? The MAC address itself could be useful. What is it about the MAC address that makes it seem "weird"?
    – Iszi
    Commented Mar 16, 2012 at 0:23
  • I say that because I've never seen the mac address before. Its not in itself strange. I have a lot of devices connected so I would just like to figure out a way to get more info. Maybe nmap or netstat or something could help?
    – Sean
    Commented Mar 16, 2012 at 0:38
  • Just check all your devices? If your wireless network is protect by WPA/WPA2 and the password is strong enough its very unlikely ( as likely as cows flying ) that somebody has accessed your network without being told the password to said network. If its not being protect by WPA/WPA2 then you should enable it.
    – Ramhound
    Commented Mar 16, 2012 at 13:35

5 Answers 5

Reset to default
14

As @logicalscope says, you can also look at the MAC lookup chart to find out the manufacturer. This could be spoofed.

You could try to find out the IP address of the device, then you could run nmap against it to see if you can identify the OS.

This could be hidden from you, so an alternative would be to try and connect to it - does it give banners back? Ports 22, 23, 80, 443 etc could be useful starting points here.

Failing that, try forcing it off the network and see if anything breaks :-)

Improve this answer
1
  • 1
    I would run nmap to see if there is a strange IP that would correspond to the MAC. You could also blacklist it and see what breaks. If a new strange MAC appears, they are probably spoofing.
    – Jeff
    Commented Mar 16, 2012 at 13:24
5

You can check the first few digits of the MAC address at https://standards-oui.ieee.org/oui/oui.txt

That'll give you the vendor of the device's NIC.

If you have access to the ARP table on your router, you can translate the MAC address to an IP address. Often with arp -a or show arp on a router commandline.

On your PC, you can check hostname of the corresponding IP and whois information:

$ nslookup <ip-address>
$ whois <ip-address>
$ whois <domainname from nslookup>

Check if you can find out the current connections to your router with a netstat-like command. Check IANA's Service Name and Transport Protocol Port Number Registry what the port is commonly used for.

This should give you a handful of leads to further analyse.

Improve this answer
2
  • 1
    Thanks a lot. Only looking into the standards.ieee.org/develop/regauth/oui/oui.txt list helped to find out that the unknown devices on my network were our Motorola Mobility phones.
    – Ivan Kovtun
    Commented Oct 22, 2020 at 17:40
  • 1
    nslookup and whois will be useless on a private IP address.
    – ThoriumBR
    Commented May 23, 2022 at 22:26
3

One way to possibly figure out what device it is, is to examine the MAC address itself. The first 3 hexadecimal numbers can be used to determine which company the MAC was assigned to. For instance, 00-03-93 is one (of many) MAC OUI prefixes that belongs to Apple.

This doesn't always work if the MAC has been spoofed, has been set manually, or if it is assigned to a virtual machine (or you have a lot of devices. :-)

Improve this answer
2

There is an easy and better way

  • just log on to router's administrative panel (usually 192.168.0.1 or 192.168.1.1)
  • log in with the administrative username and password (usually admin admin)
  • look for a tab named or starting with or containing Interface, go to Local Area Network or LAN from there and you'll see a DHCP Clients Table.

This table identifies all devices connected to the router by the device name, IP address and MAC address. On a Netgear router, click the “Attached Devices” link in the left navigation panel under the Maintenance heading.

Source

Improve this answer
2
  • The "device name" can be very vague even without malice (I've seen "Samsung", which at the time could have been one of about 6 devices). If the router weas provided by an ISP, you don't always have even such basic features.
    – Chris H
    Commented May 27, 2016 at 12:27
  • Yeah "device name" is an issue. I have multiple redmi phones at home. They all are connected as "Redmi", so I couldn't figure out which is which. That is why I made a separate txt file offline that contained device name+MAC address.
    – Ritwik
    Commented Sep 18, 2020 at 8:52
0

There's a number of OS fingerprinting tools around - some of which can operate passively (e.g. p0f), and others that can operation actively (e.g. nmap). For example to use nmap's OS detection using the -O flag (with -v for more verbosity):

sudo nmap -O -v scanme.nmap.org

There's also tools like ettercap that allow for local network mapping and OS detection.

For more on network investigation tools see Kali Tools page.

Note: These days most mobile phone OSes randomise their MAC addresses (for more info see: iOS, Android) so it's harder/impossible to identify the manufacturer from them.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .