Unknown MAC address filling up router log- Amazon Fire TV Cube

[markc6123]

Hello all,
I have this MAC address constantly being authorized and deauthorized in my router log.

Dec 11 15:50:21 wlceventd: wlceventd_proc_event(685): eth6: Auth 38:2C:E5:05:39:2A, status: Successful (0), rssi:0
Dec 11 15:50:25 wlceventd: wlceventd_proc_event(645): eth6: Deauth_ind 38:2C:E5:05:39:2A, status: 0, reason: Unspecified reason (1), rssi:0
Dec 11 15:50:25 wlceventd: wlceventd_proc_event(685): eth6: Auth 38:2C:E5:05:39:2A, status: Successful (0), rssi:0
Dec 11 15:50:29 wlceventd: wlceventd_proc_event(645): eth6: Deauth_ind 38:2C:E5:05:39:2A, status: 0, reason: Unspecified reason (1), rssi:0
Dec 11 15:50:29 wlceventd: wlceventd_proc_event(685): eth6: Auth 38:2C:E5:05:39:2A, status: Successful (0), rssi:0
Dec 11 15:50:33 wlceventd: wlceventd_proc_event(645): eth6: Deauth_ind 38:2C:E5:05:39:2A, status: 0, reason: Unspecified reason (1), rssi:0
Dec 11 15:50:33 wlceventd: wlceventd_proc_event(685): eth6: Auth 38:2C:E5:05:39:2A, status: Successful (0), rssi:0
Dec 11 15:50:37 wlceventd: wlceventd_proc_event(645): eth6: Deauth_ind 38:2C:E5:05:39:2A, status: 0, reason: Unspecified reason (1), rssi:0
Dec 11 15:50:37 wlceventd: wlceventd_proc_event(685): eth6: Auth 38:2C:E5:05:39:2A, status: Successful (0), rssi:0

The MAC doesn't appear anywhere in the client list, it does appear in the wireless log with no IP address. MAC address search returns TUYA SMART INC.
I blocked it in the router and the Amazon Fire TV cube lost internet connection. I tried ethernet to the Cube but the log entries continued.

My questions are: How is this MAC address not appearing in the device list and, what the heck is it doing, is it a problem for the router and can I stop it?

Thanks in advance.
-MarkC

 

[bennor]

My questions are: How is this MAC address not appearing in the device list and, what the heck is it doing, is it a problem for the router and can I stop it?

The Amazon Fire TV Cube may use MAC Randomization. If so see the Fire TV's settings to see if it can be turned off or can be controlled.

Edit to add: And to confirm, do you have any TUYA devices on the local network? For example any smart plugs? Is the Fire TV Cube connected to a smart plug or smart power strip?

 

[northumberland]

Are you using any kind of bridge or extender on the network?

Tuya smart sounds to me like an iot device but it could be a spoofed mac from some device that's been infected. A lot of Chinese devices, using different names/badges are tuya devices, typically using smartphone apps for control with 'smartlife' app etc.

Does the log still continue to show if you switch off the cube?

I guess some weird app to control home devices could be virtualizing a port, but doubt that this would install as standard in a fire device.

Let's see what others say.

 

[bbunge]

I have had the same issue for some time. Have checked every WIFI device in the house for the offending MAC address. Ended up blocking the MAC in wireless filter. All my WIFI devices continue to work. I suspect it is a neighbor with an unconfigured WIFI appliance.

 

[markc6123]

Now I'm getting creeped out. I turned off the Cube TV first, then gradually turned off everything else on the network. I have a mesh system, one router is ethernet backhaul and the other is wireless as the ethernet port is blown. I turned those off and everything connected to them.

I turned off my main computer and accessed the router from a laptop. Turned off wireless phones, Nvidia Shield TV, both TVs, Kindle, tablet.

The only "smart" thing in the home is my Samsung range, and it barely qualifies as moron.

The only thing I didn't unplug was the web cameras for security. (I think).

Oh and NAS and HD Homerun, but they're wired.

 

[bbunge]

Now I'm getting creeped out. I turned off the Cube TV first, then gradually turned off everything else on the network. I have a mesh system, one router is ethernet backhaul and the other is wireless as the ethernet port is blown. I turned those off and everything connected to them.

I turned off my main computer and accessed the router from a laptop. Turned off wireless phones, Nvidia Shield TV, both TVs, Kindle, tablet.

The only "smart" thing in the home is my Samsung range, and it barely qualifies as moron.

The only thing I didn't unplug was the web cameras for security. (I think).

Oh and NAS and HD Homerun, but they're wired.

Welcome to the club. Tuya Smart isn't.....

 

[RandomUser777]

I have had the same issue for some time. Have checked every WIFI device in the house for the offending MAC address. Ended up blocking the MAC in wireless filter. All my WIFI devices continue to work. I suspect it is a neighbor with an unconfigured WIFI appliance.

Did you give your neighbor your wifi password?

 

[Ripshod]

RSSI is never anything other than 0dBm, so no true connection is established. No security issue here.
Likely someone has a disconnected Tuya smart device - they'll try every network they see.

 

[markc6123]

RSSI is never anything other than 0dBm, so no true connection is established. No security issue here.
Likely someone has a disconnected Tuya smart device - they'll try every network they see.

Thanks, but wouldn't I see something in the AI Protection logs?

 

[markc6123]

Thanks everyone for the assistance. In researching this I find that when you enable and set MAC filtering you will lose wireless connectivity for a bit, so I misunderstood it when the Fire Cube TV dropped. I tried setting it again and it seems to have worked for now.