Jump to content

Unknown smartphones showing up on Network Inspector


Recommended Posts

Today I ran Network Inspector which detected that roughly a month ago a lot of unknown devices (most likely smartphones judging by their names and MAC addresses) were connected to my Wired (!?) network. At first I thought I kept my Wifi turned on and these devices were just trying to connect to my wifi (it's WPA2 protected / I use strong password), but the interface offers a separate option for the Wifi network I use under the 'Networks' dropdown menu. IP Address column is blank. The router that I connect to is owned and managed by my ISP and I have no access to it.

Link to comment
Share on other sites

The first thing that needs to be done is to verify that these smartphone connections actually exist on your gateway/router. Open your gateway/router GUI interface via browser; e.g. http://192.168.1.254 or what whatever your IPv4 gateway IP address is. Now search for these smartphone device connections.

One reason for such smartphone connections existing on your gateway/router is visitors ask to use your Wi-Fi connection and set up their smartphone on your gateway/router.

 

Link to comment
Share on other sites

21 hours ago, itman said:

The first thing that needs to be done is to verify that these smartphone connections actually exist on your gateway/router. Open your gateway/router GUI interface via browser; e.g. hxxp://192.168.1.254 or what whatever your IPv4 gateway IP address is. Now search for these smartphone device connections.

One reason for such smartphone connections existing on your gateway/router is visitors ask to use your Wi-Fi connection and set up their smartphone on your gateway/router.

 

Thank you both for the replies.

I can't verify that because I have no access to the router. It's managed by ISP and I can't even establish a connection to the interface. It refuses connection on both 80 and 443 ports. Packet analysis in Wireshark revealed that the router just replies with RST,ACK TCP packet so it seems this was blocked off in the router.

But I have physical access to the router and I'm going to check the model of the device and see whether it offers Wi-fi connectivity or not. I guess that if it has Wi-fi capability, it is possible this was activated by the ISP remotely.

12 hours ago, Aryeh Goretsky said:

Hello,

By any chance do your own smartphones have a MAC address randomization feature turned on?

 

Regards,

Aryeh Goretsky
 

No, I have only single device and I have my Wi-fi disabled. I don't think these are "randomly generated devices" based on my changing dynamic MAC address since these are completely different devices with their own names that are quite specific (non-random) such as Martin's phone etc....

Link to comment
Share on other sites

OK, so I checked the router physically and it is definitely a Wifi-capable router.

My theory is that the wifi was somehow activated by the ISP and as the people were passing by in front of my house their phones tried to establish connection automatically.

Link to comment
Share on other sites

3 hours ago, gt77 said:

I can't verify that because I have no access to the router. It's managed by ISP and I can't even establish a connection to the interface. It refuses connection on both 80 and 443 ports.

The first thing you need to do is contact your ISP and verify what equipment they issued to you.

It appears that you are using a modem versus a combo modem and router/gateway unit which is the norm these days in network communication devices issued by ISP's. All a modem does is allow your PC to connect to the ISP's network. It has no capability to set up a local subnet network and monitor its internal communication. Standard network security practice is to connect a standalone modem to a router which in turn is connected to your PC. Router's also include a hardware based firewall and optionally, IDS protection.

As far as how Eset Network Inspector reacts when interfacing with a modem, it appears it is identifying all external devices currently sharing the ISP network. In other words, Network Inspector use with a modem only connection is non-applicable.

Edited by itman
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...