Unknown MAC Address in logs

[jtiz]

In my General Log, I see many reported events of an unknown MAC address being authorized and deauthorized every few seconds:

Mar 2 21:09:26 wlceventd: wlceventd_proc_event(505): eth6: Auth D4:A6:51:30:C4:94, status: Successful (0)
Mar 2 21:09:28 wlceventd: wlceventd_proc_event(469): eth6: Deauth_ind D4:A6:51:30:C4:94, status: 0, reason: Unspecified reason (1)
Mar 2 21:09:28 wlceventd: wlceventd_proc_event(505): eth6: Auth D4:A6:51:30:C4:94, status: Successful (0)
Mar 2 21:09:30 wlceventd: wlceventd_proc_event(469): eth6: Deauth_ind D4:A6:51:30:C4:94, status: 0, reason: Unspecified reason (1)
Mar 2 21:09:30 wlceventd: wlceventd_proc_event(505): eth6: Auth D4:A6:51:30:C4:94, status: Successful (0)
Mar 2 21:09:31 wlceventd: wlceventd_proc_event(469): eth6: Deauth_ind D4:A6:51:30:C4:94, status: 0, reason: Unspecified reason (1)
Mar 2 21:09:31 wlceventd: wlceventd_proc_event(505): eth6: Auth D4:A6:51:30:C4:94, status: Successful (0)

In my Wireless Log, I also see the same MAC address always listed under 2.4ghz, but it has no IP, Tx/Rx rate, connection time, etc. Under Streams, it does show 3(b), but i have no devices that'd fit this description. It says manufacturer is Tuya Smart, but once again, no devices that could fit that description that are unaccounted for.

I've already tried removing smart home devices one by one and it remains once everything else is disconnected. Also, when I reboot or reset my router, it shows up immediately - before most other clients re-appear.

I even tried creating a Wireless MAC filter to reject this one MAC address, but when I did that, I lost wifi connectivity to ALL of my wifi devices (on 5ghz and 2.4ghz). I needed to plug my laptop into LAN via ethernet to re-access the internet and router GUI, and revert that wireless MAC filter.

Therefore, I THINK that this MAC address may not be a device/client on my network, but may have something to do with the router's 2.4ghz antenna (since it shows 3 stream in wireless log, which matches the 2.4ghz radio stream capacity).

However, not sure if this is accurate/possible, and no idea how to get rid of this unknown MAC address from my wireless log and general log.

If i change general log level to "warning" the logs disappear, but the MAC address ALWAYS remains under wireless log.

Please help me get rid of this!

Asus AX86U running the latest version of Asuswrt-Merlin firmware. However, this issue has persisted through multiple versions of firmware.

Thanks in advance!

 

[octopus]

Can you change code tag as you don't relese anything.

 

[jtiz]

Can you change code tag as you don't relese anything.

My bad - fixed.

 

[tgl]

Is that MAC address close to any addresses you *do* recognize? Many devices use several adjacent addresses.

 

[jtiz]

Is that MAC address close to any addresses you *do* recognize? Many devices use several adjacent addresses.

Good question, but no. It does not look similar to any other MAC addresses from devices currently or recently on my network.

 

[dosborne]

Do any of your devices use/support randomized Mac addresses?
Is it always the exact same Mac address? (Over a week or more)

You could always change your Ssid and see what happens if you are concerned.

 

[jtiz]

Do any of your devices use/support randomized Mac addresses?
Is it always the exact same Mac address? (Over a week or more)

You could always change your Ssid and see what happens if you are concerned.

Always the exact same MAC address. And I’ve tried switching SSID and it followed.

Not so much worried about it as a threat at this point as I am annoyed by the constant logs and figure it must be wasting resources if it’s constantly authorizing and deauthorizing.

 

[RMinNJ]

On an ssid scan I found some Xbox controllers wifi direct appearing and disappearing. Maybe some sort of wifi direct device?

 

[BobD]

iPad and iPhone can randomise their MACaddrs. If you have any in the network then check their wifi settings.

 

[Geodude633]

Just curious...have you ruled out all of your IoT devices (e.g., TreatLife smart switches, etc.)?

 

[jtiz]

On an ssid scan I found some Xbox controllers wifi direct appearing and disappearing. Maybe some sort of wifi direct device?

Just curious...have you ruled out all of your IoT devices (e.g., TreatLife smart switches, etc.)?

I've gone room by room in my house several times to make sure there are no other IoT / wifi-enabled devices, or even electronics, that I am overlooking. I've even checked to see if any of my appliances were wifi-enabled that i was unaware of.

It could be a neighbor's IoT device that isn't connected and trying to connect. I live in a condo with plenty of neighbors nearby.

HOWEVER, the fact that it shows up as 3 (b) streams leads me to believe it is not an IoT device at all... What IoT device has 3 streams or uses 802.11b standard!? My Google Home, Nest Audio, robot vac, and printer are all 1 (n or ac). Most of my other devices are 2 (ac or ax), except for my computer, which is 3 (ac). I've never seen anything else 3(b) streams.

Also, after a router reboot, this unknown mac address always shows up immediately (before most other devices) on the wireless log, but never gets assigned an IP, nor appears on the client list.

 

[jtiz]

iPad and iPhone can randomise their MACaddrs. If you have any in the network then check their wifi settings.

Checked this as well, and the MAC addresses that the iOS devices are using are accounted for and correct.

 

[RMinNJ]

Is it getting an ip? Block the address and see who complains?

 

[sbsnb]

The MAC belongs to Tuya Smart, Inc. By all appearances they are a Hong Kong based maker of smart switches, bulbs, etc. Do you have any of those sorts of devices? If not, perhaps a neighbor does.

 

[L&LD]

Change your Router and WiFi passwords. See if it still shows up.

(Or, change the SSIDs, temporarily).

If it still shows up, it may 'also' be wired.

 

[BobD]

Is it getting an ip? Block the address and see who complains?

I had an unknown a couple of days back. I blocked it and about 30 minutes later the missus complained that her iPad couldn't get Facebook. I had that one sorted out but somehow one of the settings was changed.

 

[dosborne]

HOWEVER, the fact that it shows up as 3 (b) streams leads me to believe it is not an IoT device at all... What IoT device has 3 streams or uses 802.11b standard!? My Google Home, Nest Audio, robot vac, and printer are all 1 (n or ac). Most of my other devices are 2 (ac or ax), except for my computer, which is 3 (ac). I've never seen anything else 3(b) streams.

My money would be on one of your own devices as it sounds like you have quite a few. One of them could be using a fallback technique to try and connect despite your settings. If it isn't actually connecting, then whether it is one of yours or a neighbours doesn't really matter anyway

 

[Chewie420]

are you using an iPhone or iPad?

Mine showed up as the regualar Mac and Random one.

Disabling MAC Randomization

How to disable MAC randomization.

armstrongonewire.com

 

[jtiz]

are you using an iPhone or iPad?

Mine showed up as the regualar Mac and Random one.

Disabling MAC Randomization

How to disable MAC randomization.

armstrongonewire.com

I have tried disconnecting from my network, disabling MAC randomization, airplane mode, and even turning off my phones. Also, iPhones show up as 2(AX) devices, not 3(b). So I am pretty sure it it not due to any of the iPhones in the house (no iPads).

Also, i have tried the basic troubleshooting step of turning a device off or unplugging one at a time, and then all together, to see if the mysterious MAC address disappears, but it does not.

As mentioned previously, this is the first item that shows up after a router re-boot and is always in the wireless log but never connected... Everyone in this thread seems to really expect it to be an unknown client device. I know that's the obvious thought, but I really believe this may have something to do with the router itself since it's always present, but never connected or assigned a LAN IP. It's also the only client that i've ever seen with 3 antennas, other than my apple computers, which are 3(AC). However, this unknown MAC address only tries to authenticate with the 2.4ghz network since it's of the 802.11b standard (which i don't think is even used anymore).

 

[BobD]

Block it and wait for the squeals.