I noticed yesterday that my home router (ASUS) was picking up an unrecognised device in it's traffic monitor function. This is a GUI that shows total upload/downloads by device/MAC address.
So this unrecognised MAC address is shown to be currently uploading data, at a slowish rate (around 200MB/day). I googled the first section and found the manufacturer is Alcatel.
Before changing passwords etc I thought I'd try to discover more about it, but here's the weird thing, I can't discover it. I have tried using nmap, looking in arp tables of various machines, broadcast pinging, I cannot see it at all. No other function on the router shows it, just the traffic monitor bit. I've set up a wireshark capture filtering for this MAC, but nothing shows up.
So what's going on? I can still see the traffic counter going up, and it appears to be a real MAC, but it's not discoverable by any of the means I know.
Thanks in advance.
hostapd
on Linux? That way the rogue device should connect to your computer and you'll be guaranteed to see its traffic if there is any. – André Borie Jan 23 '17 at 17:37