ASUS RT-AC87U keeps showing weird MAC addresses on the network

[element6]

I've been trying to figure this out for a while and can't.

I have two RT-AC87U routers on my network.
1 is attached directly to my modem, an Arris TM1602.
I have Optimum online (Cablevision) with a home phone.
The other RT-AC87U is across the room in Media Bridge mode with a 24 port gigabit switch attached to it.
Both routers use Merlin and are on FW 380.68_4

The router on the other side of the room is connected to the primary router on the 5GHz band and obviously does not act as a WAP being that it's in ASUS Media Bridge mode.
The router attached to the modem handles all of the WAP duties.

I have a lot of clients on the media bridge end that are wired to the bridged router; several game consoles, slingbox, my HTPC, Samsung One Connect Box, etc.

In my last home, I never had weird MAC addresses showing up on my Network clients list, but I am getting this problem constantly now. I do not want to enable MAC filtering because it would be a PITA whenever someone comes over and wants to connect to my wireless network.

I have 2 Samsung Smart UHDTV's in the home, one is wired to the bridged router and the other connects wirelessly to the main router/WAP. I have read on dslreports and somewhere else that some Samsung smart TV's create bogus MAC's to more efficiently stream content, but again, I never saw any bogus MAC's on my client list at my last home and my network environment and TV's have not changed.

The MAC's always change and don't stick around long. I have never been able to ping one of them because they always disappear off the network before I get a chance. Usually, they show up in the clients list as being connected to the wired interface, which is even weirder. In the case it were one of the TV's it would have to be my main TV, a Samsung UN65HU9000FXZA in the livingroom which has the one connect box connected by wire to the bridged router.

With that said, I have WPA2-Personal authentication on both the 2.4 and 5GHz networks and the password isn't easy for either.

Here are some screenshots I took of my clients lists when I've found some of these weird MAC's. Keep in mind that the second I click on "View List" in the ASUS web interface, they only stick around for about 3 seconds before disappearing, since they aren't active connections.

Items with green squares next to them are recognized devices on my network.
Items with red squares next to them are instances of the weird/unrecognized clients.

 

[degrub]

So isolate the tv, wired and wireless, and see if the odd addresses go away. If not, keep isolating devices one by one keeping them all isolated as you go through the list.

 

[element6]

Finally figured it out. Just by chance, I caught one of the strange MAC addresses on my network while it was still active and the IP was still pingable.

It ended up being my Cisco IP phone for work. Model 7962. In the pictures above, the hostname is SEP0024C4BF48F8. These random MAC addresses show up in addition to the real MAC address of the phone.


Very strange because it didn't do this in the past. Recently, my company did change something on the configuration of the phones that required them to send me a new one. They couldn't push an update to the original phone or even let me change settings on the old one, so they sent me a replacement 7962 back in October. I'll look into it some more and find out why it's creating so many random MAC's.