I just did a quick scan of my home network and I found this mysterious Intel desktop, looks like its an intel ethernet chipset but I just thought the name "QMDL" was sketchy and was wondering if anyone has ever seen something like this? I was wondering if it could be malicious or someone trying to look at my network traffic.
There is only one way to know for sure that whether it is a rogue device - verify that it is a device you own or not. While you do that, consider the following scenarios.
- Verify if it was a machine connected by the people who installed the router.
- Verify if it is a VM running on one of your machines in bridged mode.
- Verify if it is a mobile device like a surface tablet.
If the above three cases are invalid and the device isn't your own machines, it is likely to be rogue. If it is still online you can perform a port scan and see the results and try if you can fingerprint the same.
To make sure that it isn't snooping your network, use wireshark and see the packets from that particular IP and your router. If there are ARP responses which binds the rogue machine's MAC and your router's IP, there is a man-in-the-middle attempt and you are being snooped.
Comment below if you need the specifics on how to perform any of these.