Found a Rogue device in my network.

[Leion]

What should I do next?

Edit With more details.

Using rt-ac88u, using asuswrt version 384.12

I have a guest network which I set the ip range to be from 192.168.1.201 to 239.
All my devices and my family devices have static ip in the range between 2 to 199.

I just found 2 devices with ip 192.168.1.173 under the network map clients page. See screenshot. Mouse over shows static.

I rechecked and confirmed that the static ip was not assigned by me. It is not listed in the router dhcp static config ad well.

I rebooted the router and it's gone for now...

Any idea how should I harden the router?
I will change the wifi password. Does it help?




Sent from my SM-N960F using Tapatalk

 

[ColinTaylor]

What should I do next?

Who knows?, as you have given absolutely no information about this device or how it is connected to your network.

 

[Leion]

Any idea how to check which wireless lan the device was connected to?

Sent from my SM-N960F using Tapatalk

 

[ColinTaylor]

Any idea how to check which wireless lan the device was connected to?

Why don't you tell us first how you determined there was "a rouge device in your network", then we can progress from there.

 

[Leion]

There is a device with static ip which was not set by me. I rechecked my static ip list to confirm

Sent from my SM-N960F using Tapatalk

 

[L&LD]

There is a device with static ip which was not set by me. I rechecked my static ip list to confirm

Sent from my SM-N960F using Tapatalk

You are being extremely cryptic.

Give us a basic background of your router, firmware, network setup and possibly screenshots of the issue to allow others to help you.

 

[AndreiV]

There is a device with static ip which was not set by me. I rechecked my static ip list to confirm

Sent from my SM-N960F using Tapatalk

Your posts are really pointless.

What router are you using ? Why not post a screenshot of the client / device list you are seeing?

Without any information nobody can begin to help.

 

[Leion]

Your posts are really pointless.

What router are you using ? Why not post a screenshot of the client / device list you are seeing?

Without any information nobody can begin to help.

True. I have updated my initial post with added info.

Sent from my SM-N960F using Tapatalk

 

[L&LD]

How was it connected? Wired or Wireless?

Did you import your settings when setting up your RT-AC88U? Or did you do a full minimal and manual install after flashing it to the 384.12_0 firmware?

If you have been doing 'dirty' flashes of each new firmware for a while, that may be the source of the issue too.

I would recommend new SSID's and new passwords for all your wireless networks.

Btw, do you have a bridge/repeater/AP also in your network? Or possibly sharing with a neighbor your WiFi (without your knowledge) in the not-to-distant past?

 

[Leion]

How was it connected? Wired or Wireless?

Did you import your settings when setting up your RT-AC88U? Or did you do a full minimal and manual install after flashing it to the 384.12_0 firmware?

If you have been doing 'dirty' flashes of each new firmware for a while, that may be the source of the issue too.

I would recommend new SSID's and new passwords for all your wireless networks.

Btw, do you have a bridge/repeater/AP also in your network? Or possibly sharing with a neighbor your WiFi (without your knowledge) in the not-to-distant past?

It's a wireless connection on 2.4hz

Yes I had been doing dirty flashes...

I have just refreshed all my wifi passwords which haven't been updated for ages. No repeater or other devices.

I have also added that intruder's Mac address into the Mac filtering blacklist.

Sent from my SM-N960F using Tapatalk

 

[AndreiV]

The Mac address is an Intel powered device , maybe a laptop.

 

[dosborne]

Just an FYI, "rouge" is the french word for "red" as I believe "rogue" is the word you intended

No need to panic as you have taken the first steps if indeed someone has connected nefariously to your network. 99.9% of the time though the "culprit" is simply a device you have forgotten about or something with dual NICs. Time will tell.

To be clear though, what WiFi security are you running or have enabled? Hopefully not WEP or WPA

 

[Clark Griswald]

Just an FYI, "rouge" is the french word for "red" as I believe "rogue" is the word you intended

No need to panic as you have taken the first steps if indeed someone has connected nefariously to your network. 99.9% of the time though the "culprit" is simply a device you have forgotten about or something with dual NICs. Time will tell.

To be clear though, what WiFi security are you running or have enabled? Hopefully not WEP or WPA

"It's like those French have a different word for everything" - Steve Martin

 

[Marin]

Just an FYI, "rouge" is the french word for "red" as I believe "rogue" is the word you intended

No need to panic as you have taken the first steps if indeed someone has connected nefariously to your network. 99.9% of the time though the "culprit" is simply a device you have forgotten about or something with dual NICs. Time will tell.

To be clear though, what WiFi security are you running or have enabled? Hopefully not WEP or WPA

It is the “red” scare once again hacking our networks


Sent from my iPhone using Tapatalk

 

[Leion]

Just an FYI, "rouge" is the french word for "red" as I believe "rogue" is the word you intended

No need to panic as you have taken the first steps if indeed someone has connected nefariously to your network. 99.9% of the time though the "culprit" is simply a device you have forgotten about or something with dual NICs. Time will tell.

To be clear though, what WiFi security are you running or have enabled? Hopefully not WEP or WPA

Should be rogue

Yes I am on wpa2

Sent from my SM-N960F using Tapatalk

 

[Swistheater]

I notice the 2 symbol up by your icon

that confirms to me that the device is sharing multiple connections, or is multiple nics.

 

[HTMLSpinnr]

After restarting the router, you'll notice that almost EVERY device that remained connected and didn't solicit a new DHCP connection will identify as static. Once it attempts to renew its DHCP address, it'll return to dynamic.

 

[sfx2000]

30:24:32 IntelCor Intel Corporate

Do you have an laptop with Intel Graphics and/or an Intel WiFi card?

Could be Miracast/WiFi direct...