How to detect rogue device

Installing and Using OpenWrt
1

Greetings friends. Looking for help.

Today, I was checking my edge router (running OpenWrt) logs. There many repeating suspicious DHCPDISCOVER and DHCPOFFER for device with mac address 00:e0:4c:6e:02:57 in the morning (like 20) and then it starts repeating again after noon.
I don't have device with such mac address and also cannot determine the manufacturer from first two hex numbers. It looks like fake mac address.

Sat Mar 21 14:56:59 2020 daemon.info dnsmasq-dhcp[10305]: DHCPDISCOVER(br-lan) 00:e0:4c:6e:02:57
Sat Mar 21 14:56:59 2020 daemon.info dnsmasq-dhcp[10305]: DHCPOFFER(br-lan) 192.168.81.137 00:e0:4c:6e:02:57
Sat Mar 21 14:57:07 2020 daemon.info dnsmasq-dhcp[10305]: DHCPDISCOVER(br-lan) 00:e0:4c:6e:02:57
Sat Mar 21 14:57:07 2020 daemon.info dnsmasq-dhcp[10305]: DHCPOFFER(br-lan) 192.168.81.137 00:e0:4c:6e:02:57
Sat Mar 21 14:57:16 2020 daemon.info dnsmasq-dhcp[10305]: DHCPDISCOVER(br-lan) 00:e0:4c:6e:02:57
Sat Mar 21 14:57:16 2020 daemon.info dnsmasq-dhcp[10305]: DHCPOFFER(br-lan) 192.168.81.137 00:e0:4c:6e:02:57

How can I identify this device? Thanks

1 Like
2

Start with basics...

Are we talking about wired? which devices you have there?
Wireless? Which devices know your wifi password? Turn them off/on one by one, and monitor the logs.

One possibility is a random MAC set when the device can't read a proper MAC from its own setting. Even some OpenWrt targets have that fallback in case the MAC can't be read properly from the device.

3 Likes
3

Realtek

3 Likes
4

You can run arp to figure out what interface it is connected to.

5

Be aware that android 10 (and afaik iOS does something similar as well) devices will (by default, unless explicitly configured differently) use a unique (semi-random) MAC address for each different network.

1 Like