rare mac in traffic analyzer

[DAVIZINHO]

Hello,
In first place, sorry for my bad english, is not my natural languaje.

I have a ac88u with the Firmware:380.65_4 and configure to "movistar imagenio triple lan".

I bind all my devices with the mac adres in dhcp and in wireless mac filter. With this bind i have all the device located when i see the network map.

In the devices connected i never see a device that estranger. All my devices conected are "mine".

but when i go to "traffic analyzer" i see 2 macs adress that only make out trafic and i don´t know with devices are this.
the macs are:
00:16:C7:58:64:40

00:16:9C:3A:00:00

any idea?

 

[ColinTaylor]

Both of those MAC addresses belong to Cisco Systems.

Cable modem?

 

[DAVIZINHO]

Both of those MAC addresses belong to Cisco Systems.

Cable modem?

the router is conected to a "huawei ONT" because is a FTTH connection.
But its rare because the 2 macs make only outgoing trafic and not all the days, they have a grafical with top trafic in some hours

 

[john9527]

Switching equipment at the ISP.....check on the Tools page for the MAC that's listed as last seen on the WAN port.

 

[DAVIZINHO]

Switching equipment at the ISP.....check on the Tools page for the MAC that's listed as last seen on the WAN port.

hi,
i go to "tools section" and i can´t see any mac adress in both tabs ("sys info" or "other settings")
:-O

 

[john9527]

hi,
i go to "tools section" and i can´t see any mac adress in both tabs ("sys info" or "other settings")
:-O

I don't think it was removed....Sysinfo tab, down at the bottom (need to scroll down) under Ethernet ports.

 

[DAVIZINHO]

I don't think it was removed....Sysinfo tab, down at the bottom (need to scroll down) under Ethernet ports.

here:?

 

[john9527]

Hmmm...that's it. It does look like they removed it. Here's what I have on my fork.

 

[DAVIZINHO]

jejeje, maybe merlin removed it. i use the last Firmware:380.65_4 for rt88u :-(

 

[RMerlin]

Hmmm...that's it. It does look like they removed it. Here's what I have on my fork.
View attachment 8935

Macs aren't shown on the RT-AC88U because half of the ports are on a Realtek switch, and I can't retrieve that information from it. So rather than answer endless questions as to why half of the ports show no MAC, I removed it for that model.

 

[DAVIZINHO]

Macs aren't shown on the RT-AC88U because half of the ports are on a Realtek switch, and I can't retrieve that information from it. So rather than answer endless questions as to why half of the ports show no MAC, I removed it for that model.

Hi!, thanks for the info.

And the problem with the 2 MAC that its make upload trafic and i not have in the mac binding? how can i know wich hardware is?

 

[RMerlin]

Hi!, thanks for the info.

And the problem with the 2 MAC that its make upload trafic and i not have in the mac binding? how can i know wich hardware is?

cat /proc/net/arp

That should let you see additional details about that MAC.

 

[DAVIZINHO]

cat /proc/net/arp

That should let you see additional details about that MAC.

Perfect!, i will try it this night.
Thanks a lot!

 

[DAVIZINHO]

its still strange. in this capture you can see the 2 macs with trafic, in the grafic you can see one of this mac with trafic. and its not in mi bindings and not in my network map :-(

 

[Diamond67]

BTW, my Traffic Analyzer lists (All Clients, Merlin 380.65_2 ) the MAC Address of my Asus RT-AC68U as well. As a Client, I mean. The other day I was wondering what the f... is that device, but then noticed it is the router itself. Why is it listed?

 

[DAVIZINHO]

its very rare. any idea?

 

[Thermo]

Are you using a wifi repeater?

 

[DAVIZINHO]

Are you using a wifi repeater?

no!

 

[FTC]

Hello, I have the same provider and service and have always also observed two 'CISCO' MACs (although different from yours) being used as 'destination' for outgoing traffic with more or less continuous use. I have always assumed that one of those is associated with trendmicro protection services (the one with a normally very constant 100MB/hour traffic) and the other one is associated with the IPTV services (tends to activate when IPTV is being switched on.. plus some additional times also).

 

[DAVIZINHO]

Hello, I have the same provider and service and have always also observed two 'CISCO' MACs (although different from yours) being used as 'destination' for outgoing traffic with more or less continuous use. I have always assumed that one of those is associated with trendmicro protection services (the one with a normally very constant 100MB/hour traffic) and the other one is associated with the IPTV services (tends to activate when IPTV is being switched on.. plus some additional times also).

thanks for the info is very usefull!.

gracias compañero, me quedo mas tranquilo viendo que no es algo "raro" sino algo comun con nuestro amado movistar ;-)