unknown MAC in my IPS table

[retzer]

Hi there. I've noticed a strange MAC address in my Tw0-Way IPS table and can't find it on my IP assignment table. It's the 00:01:5C:79:BA:46 number in the top left. I'm not real worried (yet) that I have rogue device on my system but it is bothering me a bit. Hope you can see the picture ... any idea how to help me figure this one out? TIA!

 

[CaptainSTX]

Assuming it is a wireless client, try using the wireless MAC filter block it and see what happens. Just be sure you are home in case it is something important like a Roku remote, etc.

 

[ColinTaylor]

It's the MAC address of your cable modem. So it's saying that the "attacks" are arriving via the cable modem, i.e. the internet (duh!).

 

[retzer]

It's the MAC address of your cable modem. So it's saying that the "attacks" are arriving via the cable modem, i.e. the internet (duh!).

Wow, pays to be thorough. That was one of my first thoughts too. The suspect number wasn't on the label and wasn't among the MACs under the 'addresses' tab (got into it by accessing 192.168.100.1) but I just now went back into the cable modem again and looked at my event log ... there are a few dozen 'critical' entries; the top two-third entries or so on the events list have no time stamp ('time not established') and the first with a date goes back to October. They are all identical save for the time stamp and look like this:

Sun Feb 16 00:40:52 2020 Critical (3) Started Unicast Maintenance Ranging - No Response received - T3 time-out;CM-MAC=74:ea:e8:ef:9d:9b;CMTS-MAC=00:01:5c:79:ba:58;CM-QOS=1.1;CM-VER=3.0;

The first MAC is listed under the modem's addresses and the second number is the suspect. Not sure what the error means but I always assumed it was just a harmless reset because the internet has always been pretty good.

 

[ColinTaylor]

Yes, that's a normal message.