RT-AX86U phantom wired device?

[denpa]

I have Merilin 386.3_2 and my router shows (don't know when this started) a phantom wired device. I disconnected all the wires, including to the modem, disabled the VPN, and it still shows up. It has an IP: 172.31.72.174 (my network is based on 192.168.x.x). Checking the IP with IP lookup tools comes up as private/invalid. The MAC address starts with 00:AE; a MAC vendor lookup doesn't bring anything.

Any ideas what this may be? or what kind of troubleshooting I can do to find out I blocked its Internet access just to be sure.

 

[Wallace_n_Gromit]

I have Merilin 386.3_2 and my router shows (don't know when this started) a phantom wired device. I disconnected all the wires, including to the modem, disabled the VPN, and it still shows up. It has an IP: 172.31.72.174 (my network is based on 192.168.x.x). Checking the IP with IP lookup tools comes up as private/invalid. The MAC address starts with 00:AE; a MAC vendor lookup doesn't bring anything.

Any ideas what this may be? or what kind of troubleshooting I can do to find out I blocked its Internet access just to be sure.

You might try doing a search for "phantom device" or "unknown mac address" using the [Better Search] feature of the site at the top of the page.

The vendor ID portion of the MAC address starts with the first three and not just the first two in the sextet.

Try taking a snapshot of the page in the Asus GUI where you are seeing this device and post it here. Might help us troubleshoot it more quickly.

Was it listed in the WAN interface? Have you ruled out the ISP's Server device's MAC address?

 

[denpa]

When I tried a Google search, I didn't get something meaningful. I see some posts here about virtual adapters and randomized cell phone MACs but it doesn't seem to be the case here.

I did search using the whole MAC address, I didn't know if it was a good idea to post the full MAC (here are more digits: 00:AE:47:AD:x:x).

It shows up in the "clients" list.

I renamed the device to "Unknown???" and blocked its Internet traffic. I tired to force another IP address to it, but it wouldn't take,


My ISP' server's modem has a different MAC, plus I disconnected ALL wires (including going to the modem) and it will still appear there.

 

[Wallace_n_Gromit]

I did search using the whole MAC address, I didn't know if it was a good idea to post the full MAC (here are more digits: 00:AE:47:AD:x:x).~

~ My ISP' server's modem has a different MAC, plus I disconnected ALL wires (including going to the modem) and it will still appear there.

Yes, not a good idea to show all 6, just the first three. 00:AE:47:xx:xx:xx

My experience with a "phantom device" ended up being (not the Modem in your house) the MAC/IP address of the ISP's remote Gateway device which my home modem connected to and showed up in my WAN interface.

Is your router a brand new device, or was it bought used? (I wonder if a Factory default Restore w/ "Initialize all the settings..." checked would resolve this issue) That is a typical "best practices" (<-- Click on it for URL) anyway when you upgrade your default AsusWRT firmware to Merlin's version.

 

[denpa]

Thanks. It seems to be gone now, I think it was due to a SoftEther server running on one of my wired devices. However, it will still show when the device was disconnected and shut off. It took a reboot of the router to stop showing the device, even a refresh of the client list wouldn't do it.
Question: how do I force a hard client list reset/refresh, aside from a router reboot? That threw me off in my troubleshooting since the device kept showing in the list between manual and automatic refreshes (it would occasionally disappear for a second but would come right back). Again, this is for wired clients.

FYI I removed SoftEther anyway since I now use the router's build in VPN server.

 

[Wallace_n_Gromit]

~Question: how do I force a hard client list reset/refresh, aside from a router reboot?~

 

[denpa]

Tried that, but it still persisted.

 

[BobD]

I've had that problem several times of late on my Merlin RT-AX86u. It's always a wired ethernet and the address is sometimes within my defined DHCP range of 10.x.x.x. Today's event showed a 169.x.x.x address. I used to also get it on my RT-AC86U with ASUS firmware. Usually a reboot of the router clears the problem. I got very excited about it first time it happened. Somebody invading the network etc. but now I just reboot if it bothers me enough.

 

[willyburz]

I have directv genie, and the two satellite boxes show wired in my connected menu. Not a big deal, I just label all my connections and cross check with their ip.

 

[usmc8588]

I have directv genie, and the two satellite boxes show wired in my connected menu. Not a big deal, I just label all my connections and cross check with their ip.

Thank you. I created an account just to say thank you. Had this same issue and couldn't figure it out until your reply.

 

[willyburz]

All good