Randomized MAC-address in conjunction with unrecognized IP-address

Hello

I've recently installed "Wifi Guard" software on one of my servers. So far so good, I was able to identify almost all addresses in my network. But there is one that pops up once a week and I cannot identify the device.

The device HAS a randomized address with an "A" in it as a second character. So I assumed it must be one of my several Apple Devices. But since it pops up only once every six days for a few seconds, it makes me feel a bit uncomfortable. I already changed my Wifi Password and checked the access log, there was no such device listed with that MAC-address, so I presume it has not been connected to my Wifi and it must be a device in my wired LAN then.

When the device pops up in Wifi Guard it shows the randomized Mac Address: 0A:4C:42:5A:43C AND an IP-Address that is out of my Range. My normal IP range is 192.168.1.x but the address associated with the MAC-address above is something like 192.168.64.x. I am no network specialist so I keep asking myself what device could cause this? Do I have to worry about this because someone could spoofing a MAC-address in my network or can I resolve this by ticking the "Automatically mark locally administered addresses as known" checkbox in settings?

Thanks for any hint in the right direction and your help
sfreek

The address you are seeing is most likely not anything malicious. When a MAC address has an "A" as the second character, it usually means it's a locally administered or randomised address. Many Apple, Windows and Android devices do this now for privacy reasons, so the "A" strongly suggests it's one of your own devices using a random address rather than an unknown intruder.

The 192.168.64.x IP range you mentioned is also common for Apple devices when they use Internet Sharing, Personal Hotspot or virtual network adapters. It can also appear briefly when a virtual machine or network service on a Mac starts up. That's why it might only show up for a few seconds once a week.

There is no sign that anyone is spoofing your network. It is simply a normal, temporary device broadcast. You can safely tick the "Automatically mark locally administered addresses as known" option in the settings to prevent these harmless entries from showing up again.

Good morning from Switzerland

Many thanks for you detailed answer, that is a relief to me!

But I'm still a little curious so I am investigating right now if it could be one of my ORBI Satellites. In my understanding it uses a backhaul connection with an other IP range. Odd thing is why would that satellite appear in my network when only my ORBI system uses the different IP range for it's backhaul connection?

Thanks!

That's an interesting theory, and it is certainly possible that one of your ORBI satellites could be responsible, especially since they do use a separate IP range for the backhaul link. However, it is difficult to say for sure without seeing exactly how the device identifies itself on the network.

If you have a managed switch, check its MAC address table to see which port the address is coming from - that will tell you which physical segment of the network it is on.