I recently was told the username and password to get into my ISP-provided cable modem. It's a Cisco DPQ3925C.
Some poking around for unrelated purposes led me to the list of ARP entries. I didn't recognize a couple of these, so I ran
whois on the IPs. Two of them are in IP space registered to the US Department of Defense.
18.104.22.168 and 22.214.171.124 are both tied to 00:01:5C:6E:00:46. The same MAC address is also tied to the default gateway the modem received from the ISP.
Both addresses remain after a reboot.
And, needless to say, I am not on a federal network and have, to my knowledge, never connected directly to one.
Normally I'd assume there's a perfectly reasonable explanation for this, but given the security climate nowadays, I'm inclined to call shenanigans. What's going on here?