Cannot identify or block unknown MAC addresses

Question

I've only got a basic idea about networking, Google is my teacher.

• Router: Tenda D303
• Location: India
• Connection: BSNL Unlimited 1Mbps broadband.

Friends and relatives visit me often, and connect to my Wi-Fi while they're here, just for WhatsApp or emails, and nothing heavy. I tell them the WiFi password; WPS is disabled. Only I know the password to the router management page.

Since the last week or so, the connection has been very slow in my house.

• At least 30 devices were seen in the DHCP table, even though almost 25 of them weren't in my place at the time. So I changed the DHCP lease time from the default 24 hours to 3. Speeds didn't improve.
• Even with the 3-hour lease times, at late nights I notice at least 5 or more MAC addresses titled "DELL" connected, even though there are only two DELL laptops in my home.
• Changed the Wi-Fi password twice, still see the strange "DELL"s in the list at nights.
• Googled the MAC addresses, couldn't find any reliable info about them.
• Used MAC filtering to ban 5 of these odd "DELL" addresses. They're still in the list.

Also, tried resetting, rebooting all the concerned devices, and the router at home. No improvement whatsoever.

I fear that these 5 odd MAC addresses are the cause for slow internet. What can be done?

Answer 1

Four possibilities come into mind for your slow internet.

1. Your neighbors are using your wifi (e.g., you are using weak security on your router like WEP or are using very weak guessable passwords - wifi passwords can be broken offline so you need strong passphrases, or your router has a backdoor your neighbors are aware of)
2. Your neighbors are using their own router and wifi at a high rate and it is interfering with your own wifi (both operating on same part of the bandwidth)
3. You have some sort of malware (or user installed software that uses a lot of network traffic like bittorrent) installed on one or more of your systems that is using a high amount of network traffic
4. Your ISP is highly congested and isn't providing the advertised speed to you (due to multiplexing with other users).

To test, I'd first disable the wifi radio signal on the router and try to connect using a computer with an ethernet connection. If it's still slow, then most likely its an issue with your ISP being slow. However, it's also possible that it's due to malware (or other background software) on the one computer directly connected to the internet using a lot of traffic. You can test the malware theory by analyzing network traffic (e.g., with wireshark) or trying other computers as the only computer on your network or moving the computer to another network.

If it's not slow anymore, you can test all the computers you have on your network by directly connecting to the router via a wired connection. If all of them have fast speeds, then it's not malware on any of your computers. It's then probably either radio interference or neighbors connecting.

For radio interference you can possibly use a better router (e.g., 802.11ac handles interference better than 802.11b/g), changes the channel (small changes to frequency), switch to 5 GHz from 2.4GHz, move the computer closer to the router and/or use RF shielding to block signals from neighbors. There are tools and mobile apps to see if your area has a lot of wifi congestion; you may want to take a look at these and change your channel.

For neighbors connecting, you can use a stronger passphrase (e.g., at least 5 random words), possibly try a new router and/or use RF shielding.

Answer 2

Before you spend more time trying to fix the anomalous MAC address issue I'd suggest verifying it's the problem. Can you use wireshark to actually check that traffic is passing to/from the devices? (I would have made this a comment but for reasons I can't comprehend you require more reputation to comment than to answer)

You could also try switching to fixed (non-DHCP) IP addresses at least temporarily so that you can precisely control who has access and see if that resolves the speed issue.

Answer 3

Instead of banning MAC's Look to see if your modem has a whitelist for MACS. Downside you'll have to add each family member device mac address before they can use it.