Unknown Android Device
-
I recently noticed on my DHCP Server page, that what appears to be an Android device (identified as android-3854ef10afd0d6ff) had received a DHCP address. That was a red flag to me because I don’t have any Android devices. I assigned a static IP and made a LAN rule to block that address just to contain it which seems to be working. Per the logs, the ‘device’ tries to contact either DNS (53) or a couple of IP’s in China every few seconds (203.119.211.219, 203.119.217.116, 203.119.205.154). Any ideas what could be happening? I did reboot pFsense and the device came back. The only new devices I have at the house are Alexa dots which I have assigned static IP’s to and are accounted for. Blocking communication of the unknown device has no effect on the performance of the Alexa dots so I don’t believe they’re associated.
-
@slimypizza Posting situations such as this makes no sense. The device must have came from those who has access to your LAN...either household or guest. I even believe your Alexa uses Android. For sure, pfSense has NOTHING to do with this issue.
-
That's just the hostname whatever it is reports. Android does use a naming scheme like that but it could be anything with a spoofed name.
Check the MAC address, what is the OUI? That too could be spoofed of course.
Install the nmap package run it against that host.
Change your wifi passphrase if you're in any doubt.
Steve
-
He could renew the lease to see whether the device appears and got a new IP...
-
It should normally get the same address.
-
@JKnott I realized that...maybe I should have said the device accepts IP however at least he would be able to know whether the device is active and powered.
-
Thanks all. I did check the MAC, renewed the lease (before I gave it a static IP) and began taking devices offline to narrow down what this could be. Then….. I discovered a wifi picture frame my daughter had gotten and set up on the network. That was it. I’m not happy that it communicates to China with such frequency but will leave it be for now. Thanks for the feedback.
-
Mmm, worrying.
-
This DHCP server option :
might help you.
When you give away your Wifi password, "people" can connect any device they want.True, if the device permits a static IP / DNS / network / gateway setup, it could still communicate. Only firewall rules per device would really help = protect you.
Btw : connected devices nearly always 'call home'. Often, it's just the time and possible updates. Some times it's more. Before even buying stuff like this, you should 'Google them up' first.
-
@slimypizza said in Unknown Android Device:
I’m not happy that it communicates to China
Maybe it's spying on you!
-
@slimypizza said in Unknown Android Device:
I’m not happy that it communicates to China with such frequency
This below...almost always it just checking for firmware upgrade!
@Gertjan said in Unknown Android Device:
Btw : connected devices nearly always 'call home'. Often
-
Yes, probably spying on the whole family. HA! The frequency of interaction is about every 20 seconds. Seems excessive but the picture frame also allows for emailed photos and is probably checking for deliveries. Outbound communication only, it seems. No worries. Thank you all.
-
The device must have came from those who has access to your LAN...either household or guest. I even believe your Alexa uses Android. For sure, pfSense has NOTHING to do with this issue.