Unknown Wireless client. How do I identify?

Question

Level 1

145 points

Unknown Wireless client. How do I identify?

Hi,

I am checking my wireless clients and there's one in there that I don't recognize. I have WPA enabled, and have shut off everything I have that I know of that's wireless and it's still there.

I also checked the airport address and it doesn't appear to match. I don't see anything in Airport that's actually called a MAC address either, and the signal isn't moving when I use other devices.

Is there any sort of terminal command or anything that I can use to identify it? Would the airport show up in the Wireless Clients?

thanks,

Dave

Mac Pro 12 core, Mac OS X (10.6.4), ATI RadeonHD 5870, 32 gigs RAM, Wacom Intuos tablet

Posted on Apr 26, 2011 3:15 PM

Reply

Answer 1

Bob Timmons

Level 10

185,018 points

Apr 26, 2011 3:28 PM in response to Dave Taylor

The wireless clients that you are seeing is a list of devices that have received IP addressed for a specified lease time, usually 24 hours. If your iPhone has been powered off for a few days and you connect it to your wireless at say 2 PM, it will be assigned an IP address good until 2 PM tomorrow.

If you power off the iPhone at 4 PM today and check the logs, you will still see the listing for the iPhone....even though it is off.....because it has a lease until 2 PM tomorrow.

You can't use this area to see "active" devices on the network. So, chances are you are seeing a listing of one of your devices that may be off, but still has lease time left.

Now, if you have 5 wireless devices and they are all on, and you see 6 devices, that may require some investigation.

Reply

Answer 2

Dave Taylor Author

Level 1

145 points

Apr 26, 2011 3:28 PM in response to Bob Timmons

Hi Bob,

Actually, I can turn my iPhone and my iPad on and off, and see them appear and disappear. I checked those MAC addresses against my devices and those arent it. There's something else on there, but even with everything turned off I can still see this one device.

Right now, whatever it is is flatlined. Is there a way to call a terminal command? I tried arp -a and nothing came up for that particular MAC address. I did get one at the end that said the mac address was unknown though.

thanks-

Dave

Reply

Answer 3

Bob Timmons

Level 10

185,018 points

Apr 26, 2011 3:36 PM in response to Dave Taylor

I am not seeing what you are seeing regarding the on and off. You may have changed the lease times for devices? Sorry, I can't help on the Terminal. It scares me and I don't go there unless I have to.

If you have other users set up on a computer, that will sometimes appear in the log and also under the SHARED heading in the Finder if you have File Sharing enabled.

Don't forget that some devices have both an ethernet (MAC Address) and AirPort ID address, so it can be tough to keep track of devices.

Maybe another user can help us here.

Reply

Answer 4

Dave Taylor Author

Level 1

145 points

Apr 26, 2011 3:40 PM in response to Bob Timmons

yeah, under wireless clients in the advanced section, I can turn my iPhone on and off. I can see the iPhone appear as a client, then disappear when I shut it off. There's just this one address and I can't identify it.

Reply

Answer 5

May 1, 2011 7:48 PM in response to Dave Taylor

Dave Taylor wrote:

I am checking my wireless clients and there's one in there that I don't recognize.

Try using this Web page to identify the manufacturer assigned that range of MAC addresses: http://aruljohn.com/mac.pl

Reply

Answer 6

Dave Taylor Author

Level 1

145 points

May 2, 2011 2:35 AM in response to William-Boyd-Jr

Thanks for sending that one... I had already knew of something like this, but just knowing that it's an apple device is not telling me which apple device. I have several and I've shut off WiFi on all of them, but still this device registers.

Is it possible that even with WiFi/Aiport off that I'm seeing a device?

Reply

Answer 7

May 6, 2011 12:44 PM in response to Dave Taylor

Dave Taylor wrote:

just knowing that it's an apple device is not telling me which apple device. I have several and I've shut off WiFi on all of them, but still this device registers.

Is it possible that even with WiFi/Aiport off that I'm seeing a device?

That MAC assignment page isn't always helpful, but it can let someone identify a device they're not thinking about, such as a Wi-Fi printer or a cell phone "network extender". Do you have any other networking gear such as an AirPort Express?

A device that's truely off shouldn't appear. You seem to be aware that just pushing the button at the top of an iPhone doesn't really turn it off.

You might try configuring your AirPort base station for MAC address filtering to see what breaks.

Reply

Answer 8

Dave Taylor Author

Level 1

145 points

May 6, 2011 1:33 PM in response to William-Boyd-Jr

thanks... I'm still flummoxed on this one, and yes you are correct that I knew about the iPhone... actually it's the iPad that stays on, but I had already taken that address out of the equation.

I was told of an application called Wireshark that would help me figure this out, but I could never get it to work.

thanks-

Dave

Reply