Recommended Posts

Looking at my router, I see a bunch of connections and whereas I can ID some of them, there are some that I have no idea what they are, and MAC address lookup doesn't help narrow it down either (get some generic company name in China). I know what should be connected, but I am seeing some items that are named similar to one of the PC's on the network, but it is showing wireless as opposed to a wired connection, and the IP address is different as well. So I wonder if there is a good program that can scan the network and give me a map of what is connected. I know these programs exist, I am just not familiar with specifics (name, type, etc)

There is the fing app which could help.

https://www.fing.com/products/fing-app

 

Also that HE tool you just installed can scan the network via ping, has a bonjour browser, port scanner and ssl scanner all of which can be used to gather intel for stuff on your network...

 

Another option if wireless - change your psk.. You will find out what is what when it no longer connects ;)

  • Like 2
4 hours ago, BudMan said:

There is the fing app which could help.

https://www.fing.com/products/fing-app

 

Also that HE tool you just installed can scan the network via ping, has a bonjour browser, port scanner and ssl scanner all of which can be used to gather intel for stuff on your network...

 

Another option if wireless - change your psk.. You will find out what is what when it no longer connects ;)

Thanks, Fing worked great, I only have device that I can not ID, and it has this MAC address: 66:F4:39:1B:30:04 which seems to not exist.

1 hour ago, BudMan said:

Can you ping it?  Do a port scan on it, ports open can tell you a lot - try to connect to them.. See what info they send back, etc.

It responds to ping with an average of 140ms, can not connect to it, and can not get any other info from it. I think it might be a switch, we have 2 plus the PoE one.

9 minutes ago, jnelsoninjax said:

It responds to ping with an average of 140ms, can not connect to it, and can not get any other info from it. I think it might be a switch, we have 2 plus the PoE one.

 scan ports on it

 

https://www.advanced-port-scanner.com/

20 hours ago, adrynalyne said:

I doubt it’s a switch unless it’s managed. Block it and then go around the house until you find out what lost internet access. 

By process of elimination I determined it must be a smart plug, as that was the only device that was not showing up in the scans.

  • Like 2

scan all ports, not till 1023. It can be a proxy on 8080, or TOR vpn on 25620

 

ps: dont waste your time and just block it on your router security tab

 

8979879.JPG.6f256a9fc5ba21c77634d935cd2f48e5.JPG

OK, so now I am thinking it is not a smart plug:

Capture.thumb.PNG.225e0ca880d9a0d38f31a0789feace84.PNGCapture-1.PNG.68fe7ca1464c1efe144844bbd093f03d.PNG

 

It is possible that it is a cell phone, but the MAC Address does not share that assessment. The top phone is mine, and the other 2 phones in the house are Pixel 3a's, yet only one is showing.

15 hours ago, spikey_richie said:

Neighbour with an android tablet taking a free ride on your wifi? Can you block the MAC address in your router?

There is no way any neighbor is on our WiFi without our permission. Second, I don't know of any tablets that run Android 11. Third, it has disappeared. So I am thinking it was never there to start with, because it never showed up in the routers list of connected devices, just in the network map which I have spent a bit of time renaming objects so I have a really good idea of what is connected to the network now.

57 minutes ago, jnelsoninjax said:

There is no way any neighbor is on our WiFi without our permission. Second, I don't know of any tablets that run Android 11. Third, it has disappeared. So I am thinking it was never there to start with, because it never showed up in the routers list of connected devices, just in the network map which I have spent a bit of time renaming objects so I have a really good idea of what is connected to the network now.

Couldn't that just be someone passing your house in a car and it's picking up your wi-fi?

51 minutes ago, Mindovermaster said:

Couldn't that just be someone passing your house in a car and it's picking up your wi-fi?

Unlikely, we live at the end of a cul-de-sac, and we do not have a guest access to the network, so unless you know the password, there is no way you could get on to it.

14 minutes ago, jnelsoninjax said:

Unlikely, we live at the end of a cul-de-sac, and we do not have a guest access to the network, so unless you know the password, there is no way you could get on to it.

I meant that the phone just connected to the wireless, not that it got into it.

Many phones now default to using private mac addresses, you know for your "privacy" ;)

 

its quite possible for them to just use some mac that is not assigned to anyone..

 

edit: Just turned that on my iphone, and it uses mac that starts with f6:be:d0 which is not assigned to any company.

 

If was some sort of smart switch or lightbulb - they normally spew broadcast traffic... Just sitting there doing NOTHING.. So you could sniff and see if your seeing anything coming from the IP in question..

 

couple of seconds worth

 

11:35:19.877053 IP 192.168.4.62.62510 > 255.255.255.255.6667: UDP, length 172
11:35:23.325236 IP 192.168.4.65.62510 > 255.255.255.255.6667: UDP, length 172
11:35:24.236105 IP 192.168.4.61.62510 > 255.255.255.255.6667: UDP, length 172
11:35:24.257631 IP 192.168.4.63.62510 > 255.255.255.255.6667: UDP, length 172
11:35:24.494970 IP 192.168.4.56.62773 > 255.255.255.255.6667: UDP, length 172
11:35:24.555234 IP 192.168.4.58.60643 > 255.255.255.255.6667: UDP, length 172
11:35:24.572333 IP 192.168.4.50.57878 > 255.255.255.255.6667: UDP, length 172
11:35:24.576434 IP 192.168.4.57.58037 > 255.255.255.255.6667: UDP, length 172
11:35:24.577984 IP 192.168.4.59.52645 > 255.255.255.255.6667: UDP, length 172
11:35:24.587518 IP 192.168.4.52.57145 > 255.255.255.255.6667: UDP, length 172
11:35:24.590001 IP 192.168.4.72.52019 > 255.255.255.255.6667: UDP, length 172
11:35:24.591672 IP 192.168.4.55.49446 > 255.255.255.255.6667: UDP, length 172
11:35:24.596080 IP 192.168.4.71.57237 > 255.255.255.255.6667: UDP, length 172
11:35:24.604326 IP 192.168.4.53.52424 > 255.255.255.255.6667: UDP, length 172
11:35:24.606890 IP 192.168.4.51.52601 > 255.255.255.255.6667: UDP, length 172
11:35:24.610743 IP 192.168.4.54.63418 > 255.255.255.255.6667: UDP, length 172
11:35:24.882483 IP 192.168.4.62.62510 > 255.255.255.255.6667: UDP, length 172

 

 

 

 

That makes sense, the other thing I realized it could have been was my niece's girlfriend who spent a few nights over here, she had a phone, so it would make sense that it might have seen the network and tried to connect but didn't. At this point I do not care what it was, it is gone now, so that is good.

>tried to connect but didn't.

 

So it was just showing you stuff that was in the area? And it was never connected to your network?  Then how did it get an IP ;)

 

Example here is snip of list of other wifi stuff unifi ap see, just in the last hour

 

seen.thumb.png.4b2ba124c8f86329db28ceb5fcf80344.png

 

Here is last 7 days ;)

 

7days.png.27ab46bb2b94bc3e06df29966c051db7.png

 

That's a lot of stuff ;)

 

Also can see which AP picked it up, etc.

 

Your niece friend phone is most likely what it was - but unless your network is just OPEN, she would of needed to auth to get an IP.

 

I would assume many of them are phones that walk by - with their wifi hotspots on.  Or as you see here cars that drive by the house ;)  You can see that was seen by 2 of my AP as it drove by..

 

car.thumb.png.19b4a840f3e6bda0c55f3ef710ab1085.png

 

 

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • XnConvert 1.112 by Razvan Serea  XnConvert is a cross-platform batch image-converter and resizer with a powerful and ease of use experience. All common picture and graphics formats are supported (i.e. JPG, PNG, TIFF, GIF, Camera RAW, JPEG2000, WebP, OpenEXR) as well as supporting over 500 other image formats. Also available within the batch operations include rotating, adding of watermarks, adding of text along with many image-adjustment features such as brightness, shadows and more. Among the features included are: Batch adding of files and folders Support for drag and drop of files Batch rotating, cropping, resizing and more Adding of photo masks Preserving or removing image metadata in conversions Multipage image file support (i.e animated GIF, APNG, TIFF) Command line integration via NConvert Filters - such as 'Blur', 'Gaussian Blur', 'Emboss', "Sharpen' and much more Effects - such as 'Old camera' and much more Download: XnConvert 64-bit | Standalone | ~30.0 MB (Freeware) Download: XnConvert 32-bit | Standalone Links: XnConvert Website | Screenshot | Release Announcement Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Microsoft updates Visual Studio Code with chat cost tracking and multi-agent chats by Paul Hill Microsoft has just launched Visual Studio Code 1.126, its latest weekly release. This time, the company has focused on letting you see the total cost of chat sessions to spot expensive conversations; enabling multiple chats per session that run side-by-side in one agent host Copilot session; and letting you browse new folders safely in restricted mode. We have now reached the stage where free AI in IDEs is coming to an end. To help you keep track of your costs, VS Code now lets you see the entire cost of a chat session, rather than just individual turns. This should give you more transparency about which sessions consume the most credits, so you can better manage your usage over time and spend less. For those of you using the Agents window, you know it is possible to run and manage multiple agent sessions at once. In this update, a Copilot session started from an agent host can hold several chats at once. Explaining how this feature works, Microsoft writes: Finally, from this update forward, Microsoft will remove the pop-up when opening an untrusted folder. When you open a new folder now, it will automatically open in Restricted Mode. You will see a banner that lets you manage the trust level of the folder. Microsoft has made this change so that it’s easier to start inspecting code without giving it trust right away. If you have VS Code, you can check for updates within the app now to get this new version. Otherwise, you can download it from the Visual Studio Code website.
    • Anthropic accuses Alibaba of using 25,000 fake accounts to copy Claude's capabilities by Karthik Mudaliar Anthropic has accused Alibaba of using nearly 25,000 fraudulent accounts to extract capabilities from Claude on a huge scale. According to a report from Reuters, Anthropic told US lawmakers that operators linked to Alibaba and the company’s Qwen AI team generated 28.8 million exchanges with Claude between April 22 and June 5, 2026. That is a lot of Claude conversations, but Anthropic says this was not ordinary chatbot use. The company believes the accounts were part of a coordinated effort to collect answers that could help train or improve rival AI systems. The alleged campaign reportedly focused on some of Claude’s most valuable skills, including software development, multi-step reasoning, and agentic tasks. In practical terms, that means getting an AI model to plan and complete work across several stages rather than simply answering a single question. This is called 'distillation,' where AI companies use outputs from a larger model to train a smaller and cheaper one. The smaller model learns to imitate useful parts of the more capable system without needing the same amount of computing power. The distillation process isn't automatically suspicious, but the problem comes when one company gathers another provider's outputs without permission and at an industrial scale. Also, this does not mean Alibaba obtained Claude’s source code, model weights, or original training data. Instead, Anthropic claims the accounts repeatedly asked Claude carefully designed questions and collected the answers. Those answers could then be used as training material for another model. Anthropic has made similar accusations against DeepSeek, Moonshot AI, and MiniMax earlier this year. As Neowin previously reported, Anthropic said those three companies collectively generated more than 16 million Claude exchanges through roughly 24,000 accounts. Anthropic says the new campaign produced almost twice as many exchanges in a matter of weeks. Anthropic reportedly told lawmakers that the campaign could help Chinese AI developers approach the capabilities of its Mythos Preview model. Mythos is focused on advanced cybersecurity work, including finding and exploiting complex software vulnerabilities. via Reuters | Photo via DepositPhotos.com
    • An Indian manufacturer that assembles roughly one-third of Apple's iPhones and supplies semiconductor components to Tesla confirmed Monday that attackers had stolen and publicly published a 630-gigabyte cache of confidential files — including engineering blueprints stamped "TRADE SECRET," a 52-page quality inspection document for iPhone circuit board components, and cryptographic certificates that security experts say could be weaponized in follow-on attacks. https://www.techtimes.com/articles/319019/20260624/apple-tesla-supplier-tata-electronics-confirms-630-gb-data-theft-iphone-specs-dark-web.htm
  • Recent Achievements

    • Rookie
      krychek57 went up a rank
      Rookie
    • Grand Master
      Jaybonaut went up a rank
      Grand Master
    • One Year In
      Philsl earned a badge
      One Year In
    • Dedicated
      Scoobystu earned a badge
      Dedicated
    • First Post
      Tom Schmidt earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      441
    2. 2
      +Edouard
      176
    3. 3
      PsYcHoKiLLa
      133
    4. 4
      Michael Scrip
      79
    5. 5
      Xenon
      77
  • Tell a friend

    Love Neowin? Tell a friend!