Unknown devices on wifi network

I have a #G3100 router, installed several years ago

I continue to see 2 unknown devices when my desktop security software scans the wifi network.

The software gives me their MAC addresses and indicates they are mobile phones.

These devices are not on the router access list.

I followed the procedure for blocking the MAC addresses from the router. It did not work.

Further, these devices do not show up on the router device access screen or anywhere else, such as Fing, which is installed on my phone.

Can anyone tell me what is going on here?

Accepted answers

tritiumsights

Just wanted to let you guys know I fixed the problem myself.

A couple of new firewall rules and a subscription to Netcut (worth every penny).

No more intruders in network.

I believe what they were doing was spoofing my router's IP address and then creating a virtual network inside my actual network. The attacks continue without pause so I believe this is an extremely sophisticated bot operation.

Thank you for taking an interest in my issue.

All comments

tritiumsights

An addendum to my first post on this topic, made to anticipate initial questions.

When these devices were discovered some weeks ago, I changed the network name, changed the network password and disabled WPS. All this had no effect. The network appears as being locked to outsiders. It uses WPA2 security.

Everyone in my household was locked out. They had to enter the new network name and password on their devices to gain access. Their devices are listed on the device access page in the router.

Would a whitelist fix this problem? Has my router been totally hacked?

Capricorn1

A whitelist would probably be the way to go.

The MAC address isn't definitive about the device type. The first part of the MAC is assigned to a manufacturer. The last part is up to the manufacturer to assign (uniquely) to a device. For a company like Apple, the MAC address could be an iPhone, iPad, Apple TV, Apple HomePod, or some other Apple product.

Assuming the unknown devices are mobile phones, blocking the MAC address may not work. My Android phone uses a randomized MAC address for each wireless network it connects to. I can make that change by "forgetting" a wireless connection and then reconnecting.

Cang_Household

You should move onto WPA3-Personal security. WPA2-Personal does not have Simultaneous Authentication of Equals so making offline cracking Pre-Shared Key a trivial task.

Does the security scanning tool differentiate between wired and wireless devices?

tritiumsights

Thank you for response.

First of all, I would like to say for the record that Verizon will not allow me to access this site using my VPN. That deserves a long string of words which I cannot say here.

The device which I am trying to block does not use randomized MAC addresses. The G3100 router has proved ineffective at blocking this MAC address, which remains constant.

I have considered a whitelist and may go that way. Frankly, however, I doubt that G3100 will make it work.

I have used every option at my disposal - firewall rules, hiding SSID, using Netcut for temporary blocking, using Xarp for blocking ARP attacks (13,624 attacks since yesterday) and looking for a cybersecurity specialist to hire.

The device enters my network by using the IP address of my phone. It therefore bypasses the network password, which was recently changed and is very secure.

I appreciate your response. If you have anything else to say, I would like to hear it.

tritiumsights

Thank you for response.

I don't think G3100 router supports WPA3 but I will look into it.

The security scanning tool only scans the wifi network, therefore only wireless devices.

There are no wired devices on my home network.

Any further thoughts?

Capricorn1

Is the unknown device duping your phone's IP only active on the network when your phone is off? Generally, having two devices using a duplicate IP causes significant issues for those devices.

You might want to try Wireshark to monitor the MAC address of the unknown device to see what kind of traffic it is sending (and to where) and receiving (and from where).

tritiumsights

Just wanted to let you guys know I fixed the problem myself.

A couple of new firewall rules and a subscription to Netcut (worth every penny).

No more intruders in network.

Thank you taking an interest in my issue.

tritiumsights

Just wanted to let you guys know I fixed the problem myself.

A couple of new firewall rules and a subscription to Netcut (worth every penny).

No more intruders in network.

Thank you for taking an interest in my issue.