Unknown Samsung S5 using Access point IP

Rob0125Rob0125 Member Posts: 6
First Comment

Other wifi analytic apps have been showing two Hitron Access points 192.168.0.1 and 192.168.0.254

Fing revealed the .254 to be a Samsung S5 neo...of which no one in my family owns.

I have mediacom internet. Hitron CGNM. CONTROL PANEL IS BROKEN(CAPTIVE PORTAL) SO I AM WAITING FOR A NEW MODEM. I noticed two ports open on that device...Netbios-ssn 139 and microsoft -ds 445 SMB directly over IP. WHICH IT GAVE M3 AN OPTION TO ONNECT DIRECTLY TO IT.I did not connect.

Any ideas?? Im totally stumped.how do i find this phone? What are the services that are rinning on these ports? How can i find the person responsible for this?

Answers

  • Rob0125Rob0125 Member Posts: 6
    First Comment

    Other wifi analytic apps have been showing two Hitron Access points 192.168.0.1 and 192.168.0.254

    Fing revealed the .254 to be a Samsung S5 neo...of which no one in my family owns.

    I have mediacom internet. Hitron CGNM. CONTROL PANEL IS BROKEN(CAPTIVE PORTAL) SO I AM WAITING FOR A NEW MODEM. I noticed two ports open on that device...Netbios-ssn 139 and microsoft -ds 445 SMB directly over IP. WHICH IT GAVE M3 AN OPTION TO ONNECT DIRECTLY TO IT.I did not connect.

    Any ideas?? Im totally stumped.how do i find this phone? What are the services that are rinning on these ports? How can i find the person responsible for this?

  • rootedrooted Gulf Coast, USModerator Posts: 739
    500 Comments 50 Answers 100 Likes 25 Agrees
    ✭✭✭✭

    It's highly unlikely 192.168.0.254 is a phone, it's an interface on your gateway, as is 192.168.0.1.

    I don't know the function of 254 but Arris gateways have this also.

    When you say:

    I noticed two ports open on that device...Netbios-ssn 139 and microsoft -ds 445 SMB directly over IP. WHICH IT GAVE M3 AN OPTION TO ONNECT DIRECTLY TO IT

    Do you mean you are able to connect to the SMB server outside your own network or while connected to WiFi?

  • Rob0125Rob0125 Member Posts: 6
    First Comment

    While connected to wifi...in the fing android app. There is a menu button next to the poet 445 and it has an option to connect directly to it.


  • rootedrooted Gulf Coast, USModerator Posts: 739
    500 Comments 50 Answers 100 Likes 25 Agrees
    ✭✭✭✭

    A quick search for your modem shows it indeed has SMB, it must be enabled on your device. So you have nothing to worry about.

  • Rob0125Rob0125 Member Posts: 6
    First Comment

    ...But the S5 phone?? I dont own this phone..and didnt hook it up to my wifi

  • rootedrooted Gulf Coast, USModerator Posts: 739
    500 Comments 50 Answers 100 Likes 25 Agrees
    ✭✭✭✭

    Fing is incorrectly identifying the device, it's not an S5 as it wouldn't have SMB or NETBIOS

  • rootedrooted Gulf Coast, USModerator Posts: 739
    500 Comments 50 Answers 100 Likes 25 Agrees
    ✭✭✭✭

    What does a port scan of 192.168.0.1 show?

  • Rob0125Rob0125 Member Posts: 6
    First Comment

    139' 445' and 917

  • rootedrooted Gulf Coast, USModerator Posts: 739
    500 Comments 50 Answers 100 Likes 25 Agrees
    ✭✭✭✭

    You are discussing the same issue here:

    https://community.fing.com/discussion/comment/10621

    Ciaran
  • rootedrooted Gulf Coast, USModerator Posts: 739
    500 Comments 50 Answers 100 Likes 25 Agrees
    ✭✭✭✭

    Could you show me the MAC address for:

    192.168.0.1 and 192.168.0.254

  • Rob0125Rob0125 Member Posts: 6
    First Comment

    .1

    BC:4DFB:DE:1F:F2


    .254

    00:05:CA:00:00:09

  • Rob0125Rob0125 Member Posts: 6
    First Comment

    When I click on connect to samba it tells me to install this app


  • ScoobyScooby Member Posts: 135
    100 Comments 25 Awesomes 25 Likes 5 Answers
    ✭✭✭
    edited January 1
    Looking up the two MAC addresses, from this web site, shows both as "Hitron Technologies. Inc", which is for your router:
    It seems the Fing app/Fingbox may have "misidentified" the MAC address for 00:05:CA:00:00:09. Maybe @Ciaran or @Robin could look into it.
    The IP Address 192.168.0.1 should be for your Hitron gateway/router, as looking at this online manual, it mentions it as the "default" gateway/router IP:
    At this point, not sure what 192.168.0.254 is for. It is part of the DHCP IP Address "pool" of IP Addresses to issue to devices that connect to the router. As @rooted mentioned, your gateway/router does have "SMB" capability, via a DNLA media server "built-in", and USB ports (which would use SMB to allow devices to connect to USB drives attached to the router). Possible 192.168.0.254 is assigned to either one of those. Do you happen to have a USB drive connected to the router?





    rooted
  • rootedrooted Gulf Coast, USModerator Posts: 739
    500 Comments 50 Answers 100 Likes 25 Agrees
    ✭✭✭✭

    That is the designed behavior of clicking port 445 within the Fing application.

    Rob0125
  • OrangeBucketOrangeBucket Member Posts: 16
    10 Comments First Answer Photogenic
    edited January 3

    A quick Google suggests that 192.168.0.254 is used to access a USB stick should you plug one in. Disabling the USB doesn't disable the port.

  • Imrick2Imrick2 Member Posts: 1
    First Comment Photogenic
    edited January 10

    I have the same issue and am looking to identify the device as well.


    i am using a Hitron router and Mediacom is my service provider.


    I do not own a Samsung S5 Fing shows the devices OS as windows 7. It has the same IP


    what other information do you need to assist?

    ManDogDan
  • ManDogDanManDogDan Member Posts: 1
    First Comment Photogenic
    edited January 18
    I have the same issue and am using the same router. I would just like to mention that this S5 device seems to be running an old version of Android instead of windows 7, and it doesn't show up immediately after a factory reset. It always takes a little while, between 45 minutes and a couple of hours... That seems strange for a default feature of the router itself. Oh, and I should add that I don't have any USB devices connected to the router.  One other thing--when this device starts showing up in Fing, I start having trouble connecting to Steam. It doesn't seem to cause any problems connecting to the Epic game store though.  
  • rootedrooted Gulf Coast, USModerator Posts: 739
    500 Comments 50 Answers 100 Likes 25 Agrees
    ✭✭✭✭

    There is some oddness within Fing, I have a MAC address that Fing randomly identifies as other devices.

    You can see in this image an "offline" device with MAC 00:11:22:XX:XX:XX which I don't recognize, as far as I know it doesn't match any of my devices. It's currently listed as X4-43Pro which is one of my TV's which you can see at the top and has a different MAC.

    I can't elaborate further at this time.


    ManDogDan
  • RobinRobin Administrator Posts: 2,363
    100 Answers 1000 Comments 250 Likes 25 Agrees
    admin
    Hi @rooted
    I believe it is the same device with multiple ethernet cards and other MAC address is from different ethernet card. And if the device is able to connect to multiple access points then you will see multiple names but only one will be active at a time and others will be greyed out. 
    Robin (Admin at Fing)
    Getting Started? Please refer to Community guidelines & Community User Guides("Helping Hand"). HAPPY POSTING!!!
  • rootedrooted Gulf Coast, USModerator Posts: 739
    500 Comments 50 Answers 100 Likes 25 Agrees
    ✭✭✭✭

    It never happened until I got a Fingbox. And the same MAC jumps around, today Fing said it was my gateway and showed the IP was the same as my gateway. Whatever the device was it was offline.

    It's not my TV, I don't know what it is.

    ManDogDan
  • LaMuddLaMudd Member Posts: 2
    Photogenic First Comment
    Hi guys i just came upon this thread and felt relieved. I have been having a hacker trashing my PCs off and on for the past 4 years, I noticed this 192.168,0,254 Samsung neo device on my network this past year and i have been trying to ID it or geolocate it.  I am trying to make sure its not the hacker thats been stalking my familys network. 
    One thing guys i notice is in the admin options logged in to hitron i never can find the device :
     samsung neo 
    00:05:CA:00:00:09
    listed as a connected device it only shows up via every network app ive used. So its not just Fing seeing it. Whats really odd is that hitron never see's it connected, anyone have any ideas? i have nmapped it and have some copied reports i am not a IT guy so understanding everyhting is a challenege. On one of my scans it was revealed as a linux system. and was running multicast? if anyones interested i can send or post my nmap scan maybe someone here can understand it.,
    Most of my scans via nmap come back pretty much no info not even a os can be detected i must have gotten lucky when it came back as linux.
  • OrangeBucketOrangeBucket Member Posts: 16
    10 Comments First Answer Photogenic
    edited January 21

    I commented a while back that users elsewhere have identified this as the IP address used by the router to share USB drives plugged into the router, and that although they don't have USB enabled that doesn't stop the IP address showing on scans. This was consistent with something @Scooby had already suggested. Did anyone look further into this?

  • LaMuddLaMudd Member Posts: 2
    Photogenic First Comment
    well i dont have any usb drives or any drives plugged in. so it showing up as a samsung phone isnt strange? lol 

Sign In or Register to comment.