Unkown MAC address on Guest 2

[EPR]

Noticed this week a unknown MAC address, CC:8C:BF:92:AA:5E, in the wireless log. It's trying 4 times every 2-3 minutes, seeing in log.

Major log pollution...

May 26 10:06:12 wlceventd: wlceventd_proc_event(645): wl0.2: Deauth_ind CC:8C:BF:92:AA:5E, status: 0, reason: Unspecified reason (1), rssi:0
May 26 10:06:12 wlceventd: wlceventd_proc_event(685): wl0.2: Auth CC:8C:BF:92:AA:5E, status: Successful (0), rssi:0

Search shows, Tuya Smart Inc.

Only clients on this 2.4ghz Guest 2 network are Nest. Is this a Google update service?

Do not think I can block it in Wireless MAC Filter?

System Log - Wireless Log:
no device name
no ip address
RX/TX RSSI no data
connected 0.0
stream 3 (b)
flags _______

I did remove all the Nest clients, deleted apps restarted, same.

Factory reset to this router, same.

Now trying to hide the SSID... waiting to see. But will this just hide the problem?

 

[OzarkEdge]

Do not think I can block it in Wireless MAC Filter?

You can try... and then you may discover which device it is. Beware random MACs with smart devices.

OE

 

[RMerlin]

Tuya makes IoT devices like smart power plugs.

 

[EPR]

Hiding SSID on Guest 2, no help.

Now lets see if the MAC Filter, reject in Guest 2 works.

@RMerlin , any thoughts, this just started when I updated from 388.6_2 to 388.7 version?

 

[OzarkEdge]

Hiding SSID on Guest 2, no help.

This is a cosmetic setting... nothing is really hidden and clients can still connect to so-called hidden SSIDs.

OE

 

[EPR]

This is a cosmetic setting... nothing is really hidden and clients can still connect to so-called hidden SSIDs.

OE

Figured that, just saw the Name display [Hidden SSID] MAC still there.

Think it might be a neighbors, nothing new has been added or plugged in here lately.

Reject MAC in the Guest 2 network seems to be holding it back now for 1 hours. It will show up now...

 

[StR]

I posted about the same issue almost at the same time:

Repeated Wi-Fi connection attempts are not fully blocked

I've been getting these lines filling up system log of RT-AC86U, about 18 times per minute.: eventd: wlceventd_proc_event(530): wl0.2: Auth FC:67:1F:40:92:C7, status: Successful (0), rssi:0 This is not one of the devices that was given credentials to my network. When I look at the "Wi-Fi" log...

www.snbforums.com

[Edited:] MAC filter doesn't seem to help. does work, but you have to apply it to each SSID separately, including the guest ones.

 

[OzarkEdge]

[Edited:] MAC filter doesn't seem to help. does work, but you have to apply it to each SSID separately, including the guest ones.

If you have to block a real client/MAC that is not your device from logging into multiple networks/SSIDs, then you should change login credentials instead, imo.

OE

 

[StR]

If you have to block a real client/MAC that is not your device from logging into multiple networks/SSIDs, then you should change login credentials instead, imo.

OE

It is connecting but it is not authenticating, as it doesn't have the credentials.
See the screenshot in my thread showing the status of this device.

 

[peng]

Hi, I have the same issue happening after an update to the 388.7 version. I have the RT-AX56U and I understand it is EOL however this issue is very similar to yours if not the same: a random device with MAC address starting with CC:8C:BF (Tuya Smart in wireless stats) keeps trying to authenticate. Not sure if it is an actual device or a bug. Currently trying to block it and test again.

 

[bennor]

a random device with MAC address starting with CC:8C:BF (Tuya Smart in wireless stats) keeps trying to authenticate.

Are you using any Tuya Smart IoT devices? If so, maybe start by turning them all off to see if the issue stops. If so then turn each one on, one at a time and check for the issue, to see which is the offending device. As already indicated earlier up discussion some devices (for example cell phones) will have the option to randomize their MAC address. One may be able to turn off that randomization within the device settings (or device app) itself.

If you have family members or friends in your location, perhaps one of them added, or is trying to add, a new device to the WiFi network without your knowledge.

 

[peng]

Are you using any Tuya Smart IoT devices? If so, maybe start by turning them all off to see if the issue stops. If so then turn each one on, one at a time and check for the issue, to see which is the offending device. As already indicated earlier up discussion some devices (for example cell phones) will have the option to randomize their MAC address. One may be able to turn off that randomization within the device settings (or device app) itself.

If you have family members or friends in your location, perhaps one of them added, or is trying to add, a new device to the WiFi network without your knowledge.

No, I do not have any Tuya devices. I have checked the MAC addresses (including randomized addresses) for all of my devices and this address does not correspond with any. As soon as I turn the wireless MAC filtering off it instantly appears in the wireless clients 2.4GHz section.
Although I'm not sure whether this could be random devices trying to connect from my neighbor as I live in an apartment (maybe changing the SSID could help?).

 

[bbunge]

No, I do not have any Tuya devices. I have checked the MAC addresses (including randomized addresses) for all of my devices and this address does not correspond with any. As soon as I turn the wireless MAC filtering off it instantly appears in the wireless clients 2.4GHz section.
Although I'm not sure whether this could be random devices trying to connect from my neighbor as I live in an apartment (maybe changing the SSID could help?).

Changing the SSID will not work. Just use the MAC Filter to deny the address on both 2.4 and 5 GHz bands.

 

[EPR]

Blocking this on the 2.4 GHz Guest 2 Network where I found it, with my Nest cameras, worked. Also changed password on Guest 2.

Yesterday I factory reset & wiped logs on this router. Have not see it on the Guest 2 Network, or anywhere so did not block it, 24 hours and still good.

Watching...