2

Previously, I mentioned 5 unknown MAC addresses often connecting to my router, and noticeably causes my internet to be slow.

Router: Tenda D303, Location: India, Connection: BSNL Unlimited 1Mbps broadband.

User drjimbob helped to eliminate other possible causes for slow internet, and here’s my research:

  1. “Possibly weak passphrase for Wi-Fi, hence neighbours using it.”

I’ve been using WPA2-PSK authentication, with AES encryption. Tried several complex passphrases for a month now. There are no neighbours other than some close family members, and I have discussed with them this issue.

  1. “Interference from neighbours’ routers.”

It’s more like a countryside, more greenery, and less routers in here. I couldn’t find any visible Wi-Fi access points or a router other than mine in my home and vicinity. Also, not many wireless equipment here that could cause interference.

  1. “Malware or user-installed software like bittorrent using up bandwidth.”

Couldn’t find any malware on any of my devices, nor any heavy downloading.

  1. “ISP’s problem.”

Highly unlikely because when I disable Wi-Fi and use internet via Ethernet from the same router, all works fine, on all PCs.

Now let's set aside the slow internet issue. These 5 MAC addresses, all starting with 00:ff, and titled “DELL” in the DHCP table is what troubles me.

  • My research shows a clear correlation between slow internet and presence of these 5.
  • I “banned” these 5 under router’s MAC filter, yet they pass through.
  • These 5 are not my devices. My 2 DELL laptops appear separately with their own MAC addresses starting with 9c:2a and 64:5a respectively. I even checked all my other devices’ MAC addresses.

Questions:

  1. What are these 5 MAC addresses?
  2. How do I get rid of them?

EDIT: The 5 MAC addresses are: 00:ff:93:86:02:04, 00:ff:10:ad:b7:82, 00:ff:14:97:c9:73, 00:ff:eb:72:a3:85, 00:ff:f6:cc:8e:f7

  • 1
    It would help if you posted the full MACs. Forget the Dell part for a second. If you google the phrase "MAC address 00:ff" you will see a few reasons for what they might be including monitors, bridged devices, etc. They might be your own machines. – schroeder Oct 17 '16 at 9:43
  • 3
    Install and run wireshark, capture the packet and post/google those packet info. Otherwise it will be wild goose chasing. – mootmoot Oct 17 '16 at 12:18
  • @schroeder Updated question with MAC addresses. I have no wireless monitor, fridge, TV or any such thing. All I have connected to this network are some laptops and phones. – NVZ Oct 17 '16 at 16:38
  • 1
    If you read the links on a search, they might be your own computers. Packet captures are the only way to track down who they are. – schroeder Oct 17 '16 at 16:43
  • @schroeder I have been reading some stuff on Google. I'm not very familiar with these jargon, and I'm doing my best. – NVZ Oct 17 '16 at 16:44
8
+50

Those 5 MAC addresses all are in the 00:FF domain, which are traditionally used for bridged/routed adapters. They aren't assigned to any individual vendor by the IEEE. In this case, you have two possibilities:

1) A malicious actor somehow spoofing MAC addresses on your internal network, or

(much more likely)

2) A computer on your network has some type of virtual (VPN, Virtual Machine, Docker Container, Internet Connection Sharing, etc) adapter(s) which are registering with your router as they show up in the subnet's ARP table. Perhaps traffic generated by those sessions is causing the internet to be slow, as 1MBps can easily be clogged up by streaming or downloading etc.

It's likely the reason that banning them on your router's DHCP table doesn't seem to work is that they don't need DHCP to function -- they're using the host computer's IP address. They're also having traffic routed through that main computer's interface, thus using the main computer's MAC address.

In the end, as others have suggested the only way to conclusively determine what the issue is would be to run a packet capture/trace to see what traffic that MAC address is generating, which might require changing the router with one that supports such inspection.

Reference: Lookup MAC by Vendor - https://regauth.standards.ieee.org/standards-ra-web/pub/view.html#registries

  • Thank you. I will look into packet capturing method. I'm not familiar with such tricks, but I'll learn quickly. – NVZ Oct 17 '16 at 17:08
  • I would add for 2) point: Do you use VMWare, Xen, VirtualBox, Qemu or any virtual machine software ? If so, probably VMs virtual MAC. – binarym Oct 20 '16 at 18:16
  • 1
    @binarym I did mention VMs, but the OP did state in response to a comment that he is not running virtual machines. – Herringbone Cat Oct 20 '16 at 18:59
  • This helped me. I have been away from home, hence the delay to test this and reply. The 5 "DELL"s apparently do not appear when one of my DELL laptops is turned off. I will need to format that laptop, because I am not sure why it adds these extra MACs. Will report back with further findings, if any. – NVZ Oct 23 '16 at 14:09
2

1.What are these 5 MAC addresses?

Insufficient information to evaluate. Actually unwanted hosts, it's all that you need to know for now.

2.How do I get rid of them?

2.0 : Implement a whitelist, so only registered hosts can use your network.

2.1 : Create firewall rules to drop these hosts.

If everything fails:

Analyze your network packets using a sniffer and detect what kind of activities these hosts are doing. Attack your own network with Arp Poison or Mac Flood and then analyze all the packets coming from these unwanted hosts. if it's not necessary sniff everything anyway and keep packets for further analysis.

In case of persistence(I doubt) install IPS(virtual machine with bridged connection) and HIDS on your hosts. Analyze some activity logs. If nothing works maybe your router have a known vulnerability(?).

What happens when you reset your wifi? Are these hosts connecting immediately?

You're probably missing something obvious.

  • Thank you for the response. When I reset router, the DHCP table is cleared. Then some hours later, these 5 MACs re-appear out of nowhere. – NVZ Oct 17 '16 at 16:42
2

While it wouldn't be fair to rule out a malicious presence, there's a very strong chance that one of your Dell's is registering a virtual connection with the router- thereby creating these DHCP table entries.

Aside from downloading a packet sniffer like Wireshark & digging into the traffic going through your router in an attempt to verify the legitimacy of those entries... I would suggest taking a closer look at each computer's network properties to verify there are no additional adapters other than a wired/wireless connection.

In an attempt to figure out whether or not a singular computer is causing the problem~ try disconnecting one computer from the router, resetting it, & using the other computer to verify the ghost MACs appear again. If they do, use the same process on the other computer.

Hope I've given some ideas as to how to address this.

  • @NVZ - It's possible each device creates separate routing table entries. The router's specification page says it enables a Wireless Access Control feature or Wireless MAC filter which raises a flag to me. Perhaps proprietary programming, with the idea of enhancing security, creates computational congestion. In order to clarify your fourth point, disabling wireless connections on the router gets rid of the ghost MACs? – user124863 Oct 20 '16 at 1:46
  • Disabling WiFi disabled the ghosts, yes. – NVZ Oct 20 '16 at 1:48
  • @NVZ - Do you normally have five devices connected to your router? & when you mentioned you reset the router, can you comment on whether it was a complete reset? The goal would be to clear any cache that may allow the ghost MACs to be reestablished. – user124863 Oct 20 '16 at 1:52
  • Complete resets, including clearing dhcp list, resetting passphrase, reentering ISP details etc. I normally have some 10 devices connected any time, some of them being phones and laptops of my family members. – NVZ Oct 20 '16 at 1:53
  • 1
    @NVZ - Just checking to see if you completed a hard reset or a soft reset of the router's software. If a factory reset has yielded no results & there's no correspondence between the number of devices you've had connected to the router with the number of ghost MACs you see~ definitely look into a packet sniffer. Good luck! – user124863 Oct 20 '16 at 1:58
2

Regarding interference from other wifi APs please take into consideration wifi APs with hidden SSID running on overlapping channels that can interfere with your.Therefore,try to monitor all wifi access points within range using proper software such as inSSIDer.I would also suggest you consider the following steps;

  1. Reset your router to factory settings.
  2. configure your router using cable connection.
  3. Hide your wifi AP SSID and set strong password.In the wifi settings determine Transmit power of your wifi based on your need.High transmit power means your AP in reachable from farther distance and gives a chance to intruders.
  4. I suppose you have a fixed number of devices so it would be better to give each device a static IP for this experiment.Furthermore, determine MAC addresses of your devices and activate MAC filtering.
  5. When your devices are all connected check to see if suspicious MAC addresses appear again.
  6. If you don't see suspicious MAC addresses anymore, switch to DHCP again but use DHCP Reservations for assigning IP addresses.In some ways this is similar to static IP addressing. How to Set Up DHCP Reservations In addition try limiting your IP pool size to maximum number of devices you think need to be connected to your network.
0

Configure MAC Address filtering which is provided by Tenda-D303. and create a whitelist for all your devices known MAC Addresses.

  • Did that but didn't work. Finally identified that one laptop, in particular, was showing up with 5 MAC addresses in addition to its own. – NVZ Jan 21 '17 at 6:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.