Is someone trying to access my router?

[Larceny]

I see the following in the router. A bit concerning.

May 11 22:56:06 syslog: wlceventd_proc_event(530): eth1: Auth 4E:C4:FD:B3:80:C9, status: Successful (0), rssi:0
May 11 22:56:06 syslog: wlceventd_proc_event(559): eth1: Assoc 4E:C4:FD:B3:80:C9, status: Successful (0), rssi:0
May 11 22:56:12 syslog: wlceventd_proc_event(494): eth1: Deauth_ind 4E:C4:FD:B3:80:C9, status: 0, reason: 4-way handshake timeout (f), rssi:0
May 11 22:56:14 syslog: wlceventd_proc_event(530): eth1: Auth 4E:C4:FD:B3:80:C9, status: Successful (0), rssi:0
May 11 22:56:14 syslog: wlceventd_proc_event(559): eth1: Assoc 4E:C4:FD:B3:80:C9, status: Successful (0), rssi:0
May 11 22:56:20 syslog: wlceventd_proc_event(494): eth1: Deauth_ind 4E:C4:FD:B3:80:C9, status: 0, reason: 4-way handshake timeout (f), rssi:0

I looked up the MAC address, but got no results. https://macaddress.io/mac-address-lookup/W5A9egpL5P
"The MAC address does not belong to any registered block."

Do I need to worry about this?

Router: AC68U
Firmware: 386.13 (Merlin)
SSID name: ASUS

 

[OzarkEdge]

I see the following in the router. A bit concerning.

May 11 22:56:06 syslog: wlceventd_proc_event(530): eth1: Auth 4E:C4:FD:B3:80:C9, status: Successful (0), rssi:0
May 11 22:56:06 syslog: wlceventd_proc_event(559): eth1: Assoc 4E:C4:FD:B3:80:C9, status: Successful (0), rssi:0
May 11 22:56:12 syslog: wlceventd_proc_event(494): eth1: Deauth_ind 4E:C4:FD:B3:80:C9, status: 0, reason: 4-way handshake timeout (f), rssi:0
May 11 22:56:14 syslog: wlceventd_proc_event(530): eth1: Auth 4E:C4:FD:B3:80:C9, status: Successful (0), rssi:0
May 11 22:56:14 syslog: wlceventd_proc_event(559): eth1: Assoc 4E:C4:FD:B3:80:C9, status: Successful (0), rssi:0
May 11 22:56:20 syslog: wlceventd_proc_event(494): eth1: Deauth_ind 4E:C4:FD:B3:80:C9, status: 0, reason: 4-way handshake timeout (f), rssi:0

I looked up the MAC address, but got no results. https://macaddress.io/mac-address-lookup/W5A9egpL5P
"The MAC address does not belong to any registered block."

Do I need to worry about this?

Router: AC68U
Firmware: 386.13 (Merlin)
SSID name: ASUS

That looks like WiFi client activity... clients today can use random MACs that you can't resolve... a setting on the client. Could be your device; could be the kid next door playing around. Used good passwords. And while you're at it, scan your WAN connection using GRC.com Shield's UP\all service ports to see if you have any open ports.

OE

 

[Larceny]

That looks like WiFi client activity... clients today can use random MACs that you can't resolve... a setting on the client. Could be your device; could be the kid next door playing around. Used good passwords. And while you're at it, scan your WAN connection using GRC.com Shield's UP\all service ports to see if you have any open ports.

OE

Thanks for the reply.
This connection log just popped up in my router.

May 12 13:52:12 syslog: wlceventd_proc_event(530): eth1: Auth 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:12 syslog: wlceventd_proc_event(530): eth1: Auth 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:12 syslog: wlceventd_proc_event(559): eth1: Assoc 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:12 syslog: wlceventd_proc_event(559): eth1: Assoc 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:12 syslog: wlceventd_proc_event(559): eth1: Assoc 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:20 syslog: wlceventd_proc_event(494): eth1: Deauth_ind 62:AB:9A:1D:49:BD, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3), rssi:-74
May 12 13:52:22 syslog: wlceventd_proc_event(530): eth1: Auth 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:22 syslog: wlceventd_proc_event(559): eth1: Assoc 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:30 syslog: wlceventd_proc_event(494): eth1: Deauth_ind 62:AB:9A:1D:49:BD, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3), rssi:-74

I wasn't using any wifi related products the moment the log was created .
Except for my solar panels which are connected to an Envoy Enphase router, which is something I can't disconnect.
But I can't simply trace these logs back to if they are coming from the Envoy Router or something else for that matter. Which is really bugging me.

Any help is appreciated.

 

[OzarkEdge]

Thanks for the reply.
This connection log just popped up in my router.

May 12 13:52:12 syslog: wlceventd_proc_event(530): eth1: Auth 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:12 syslog: wlceventd_proc_event(530): eth1: Auth 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:12 syslog: wlceventd_proc_event(559): eth1: Assoc 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:12 syslog: wlceventd_proc_event(559): eth1: Assoc 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:12 syslog: wlceventd_proc_event(559): eth1: Assoc 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:20 syslog: wlceventd_proc_event(494): eth1: Deauth_ind 62:AB:9A:1D:49:BD, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3), rssi:-74
May 12 13:52:22 syslog: wlceventd_proc_event(530): eth1: Auth 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:22 syslog: wlceventd_proc_event(559): eth1: Assoc 62:AB:9A:1D:49:BD, status: Successful (0), rssi:0
May 12 13:52:30 syslog: wlceventd_proc_event(494): eth1: Deauth_ind 62:AB:9A:1D:49:BD, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3), rssi:-74

I wasn't using any wifi related products the moment the log was created .
Except for my solar panels which are connected to an Envoy Enphase router, which is something I can't disconnect.
But I can't simply trace these logs back to if they are coming from the Envoy Router. Which is really bugging me.

Any help is appreciated.

The log activity is normal for wireless clients connecting and disconnecting. If you suspect unauthorized clients, change your WiFi password and put your clients back on your network.

OE