gt77 0 Posted December 1, 2023 Share Posted December 1, 2023 Today I ran Network Inspector which detected that roughly a month ago a lot of unknown devices (most likely smartphones judging by their names and MAC addresses) were connected to my Wired (!?) network. At first I thought I kept my Wifi turned on and these devices were just trying to connect to my wifi (it's WPA2 protected / I use strong password), but the interface offers a separate option for the Wifi network I use under the 'Networks' dropdown menu. IP Address column is blank. The router that I connect to is owned and managed by my ISP and I have no access to it. Link to comment Share on other sites More sharing options...
itman 1,748 Posted December 1, 2023 Share Posted December 1, 2023 The first thing that needs to be done is to verify that these smartphone connections actually exist on your gateway/router. Open your gateway/router GUI interface via browser; e.g. http://192.168.1.254 or what whatever your IPv4 gateway IP address is. Now search for these smartphone device connections. One reason for such smartphone connections existing on your gateway/router is visitors ask to use your Wi-Fi connection and set up their smartphone on your gateway/router. Link to comment Share on other sites More sharing options...
ESET Moderators Aryeh Goretsky 387 Posted December 2, 2023 ESET Moderators Share Posted December 2, 2023 Hello, By any chance do your own smartphones have a MAC address randomization feature turned on? Regards, Aryeh Goretsky Link to comment Share on other sites More sharing options...
gt77 0 Posted December 2, 2023 Author Share Posted December 2, 2023 21 hours ago, itman said: The first thing that needs to be done is to verify that these smartphone connections actually exist on your gateway/router. Open your gateway/router GUI interface via browser; e.g. hxxp://192.168.1.254 or what whatever your IPv4 gateway IP address is. Now search for these smartphone device connections. One reason for such smartphone connections existing on your gateway/router is visitors ask to use your Wi-Fi connection and set up their smartphone on your gateway/router. Thank you both for the replies. I can't verify that because I have no access to the router. It's managed by ISP and I can't even establish a connection to the interface. It refuses connection on both 80 and 443 ports. Packet analysis in Wireshark revealed that the router just replies with RST,ACK TCP packet so it seems this was blocked off in the router. But I have physical access to the router and I'm going to check the model of the device and see whether it offers Wi-fi connectivity or not. I guess that if it has Wi-fi capability, it is possible this was activated by the ISP remotely. 12 hours ago, Aryeh Goretsky said: Hello, By any chance do your own smartphones have a MAC address randomization feature turned on? Regards, Aryeh Goretsky No, I have only single device and I have my Wi-fi disabled. I don't think these are "randomly generated devices" based on my changing dynamic MAC address since these are completely different devices with their own names that are quite specific (non-random) such as Martin's phone etc.... Link to comment Share on other sites More sharing options...
gt77 0 Posted December 2, 2023 Author Share Posted December 2, 2023 OK, so I checked the router physically and it is definitely a Wifi-capable router. My theory is that the wifi was somehow activated by the ISP and as the people were passing by in front of my house their phones tried to establish connection automatically. Link to comment Share on other sites More sharing options...
itman 1,748 Posted December 2, 2023 Share Posted December 2, 2023 (edited) 3 hours ago, gt77 said: I can't verify that because I have no access to the router. It's managed by ISP and I can't even establish a connection to the interface. It refuses connection on both 80 and 443 ports. The first thing you need to do is contact your ISP and verify what equipment they issued to you. It appears that you are using a modem versus a combo modem and router/gateway unit which is the norm these days in network communication devices issued by ISP's. All a modem does is allow your PC to connect to the ISP's network. It has no capability to set up a local subnet network and monitor its internal communication. Standard network security practice is to connect a standalone modem to a router which in turn is connected to your PC. Router's also include a hardware based firewall and optionally, IDS protection. As far as how Eset Network Inspector reacts when interfacing with a modem, it appears it is identifying all external devices currently sharing the ISP network. In other words, Network Inspector use with a modem only connection is non-applicable. Edited December 2, 2023 by itman Link to comment Share on other sites More sharing options...
Recommended Posts