Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Help finding rogue mac in dhcp lease

    Scheduled Pinned Locked Moved DHCP and DNS
    5 Posts 3 Posters 2.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      georgeberz
      last edited by

      I have assigned static IP addresses to al lknown computers and devices on my network, however 1 unknown keeps popping up at 1am every night! How can I track this down and identify what it is?

      the one with the dhcp issued ip address of .151

      mac.jpg
      mac.jpg_thumb

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        I show that as private?

        http://hwaddress.com/mac/F0A225-000000.html

        I would suggest you sniff traffic for that mac and see what else its doing, if anything?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • C
          clarknova
          last edited by

          What layer 2 devices do you have on your network, ie, wireless access points, switches, etc. If they are manageable, they can usually tell you something about where that device is connected.

          db

          1 Reply Last reply Reply Quote 0
          • G
            georgeberz
            last edited by

            Well I found it as a total fluke…. stumbled across it

            my kids new kindle has wifi and even when turned off I guess it phones home at 1am every night

            I have no idea if any stuff I have is layer2 all my stuff is cheapo netgear 10/100 and d/link stuff

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              Odd that the kindle wifi mac is listed as PRIVATE??

              Normally you can just look up the mac and get the maker, which can help you trouble shoot the issue.

              Glad you figured out what it was by accident, but if you would of sniffed you would of seen it talking to where it talks to, etc  And that should of pointed you to what device it was.

              I have a cheapo netgear switch, and its "smart" and I can view mac addresses and such, just because its cheap does not mean it can not be loaded with features.  I had picked up my GS108T for like $79, does vlans, mirror port, igmp snooping, lagg, qos, rate limiting, etc. etc.

              Next time your in the market for a switch you might want to look for a smart one, normally only a few dollars more.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.