I am using a linksys router with DD-WRT firmware with a WiBro internet connection, the ISP uses a hub with multiple user connected to it. The issue is that an unidentified MAC address seems to pop up in the routers LAN with a local ip address. It does not show in the wlan area, only on the LAN.

the MAC is this 12:34:56:6C:9A:CC

so what is this.. is it a ddos attack or.....

  • What devices are connected to the router? And are there any devices connected to those devices?
    – Hammo
    Jan 14, 2013 at 8:52

3 Answers 3


It doesn't look like a DDOS (Distributed Denial of Service) attack.

12:34:56 is an unknown OUI (Organizationally Unique Identifier)

You can understand more about this MAC address by listening on the LAN with a protocol analyzer like Wireshark.


Figure out what's on your LAN, whether it be printers, computers, cellphones, game consoles etc. If you are sure this device doesn't belong on your network, you can implement a MAC filter, which is by no means completely secure as MAC addresses can easily be spoofed, but it can work in some situations. The first half of that address looks suspiciously like a spoofed address (12:34:56:). The best thing to do as Christan mentioned is look at traffic with wireshark and see what this device is actually doing.


First figure out what all devices are connected to your wifi router and see if the mac address mentioned matches with some of those devices and if then also you are not able to figure out the device then ban the mac address from connect

  • 1
    As this is clearly a spoofed mac, banning it wouldn't do a great deal.
    – lynks
    Jan 15, 2013 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .