4

I noticed yesterday that my home router (ASUS) was picking up an unrecognised device in it's traffic monitor function. This is a GUI that shows total upload/downloads by device/MAC address.

So this unrecognised MAC address is shown to be currently uploading data, at a slowish rate (around 200MB/day). I googled the first section and found the manufacturer is Alcatel.

Before changing passwords etc I thought I'd try to discover more about it, but here's the weird thing, I can't discover it. I have tried using nmap, looking in arp tables of various machines, broadcast pinging, I cannot see it at all. No other function on the router shows it, just the traffic monitor bit. I've set up a wireshark capture filtering for this MAC, but nothing shows up.

So what's going on? I can still see the traffic counter going up, and it appears to be a real MAC, but it's not discoverable by any of the means I know.

Thanks in advance.

|improve this question
  • 1
    Can you set up your computer as an access point with identical settings as your router (including its BSSID) using hostapd on Linux? That way the rogue device should connect to your computer and you'll be guaranteed to see its traffic if there is any. – André Borie Jan 23 '17 at 17:37
  • Have you tried with arping ? – Sorcha Jan 24 '17 at 13:31
  • I have tried arping yes, I just get "Unknown host <MAC>" – spoovy Jan 25 '17 at 8:00
  • I will try to do as you suggest Andre, when I get chance. This weekend probably. – spoovy Jan 25 '17 at 8:00
4

It occurred to me what this was after a couple of days. It was traffic being 'uploaded' to the router from the modem. I googled and sure enough Alcatel provide the modems for my broadband provider (BT).

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.