two new MAC's detected at the same time but now IP assigned

EricSouth
EricSouth Member Posts: 3
First Comment
Four different times over the past 3 weeks I've had the FingBox detect new devices on the network.  They come in pairs, with identical timestamps.  No IP address is assigned to the new devices.  I can't find any info on the MAC addresses.  They appear to be random.  6 of the alerts came in after hours when nobody was in the offfice.  Any idea what might be causing this?

Answers

  • kltaylor
    kltaylor Member, Beta Tester Posts: 1,231
    1000 Comments 500 Likes 50 Answers 100 Awesomes
    ✭✭✭✭✭✭
    Hi @EricSouth, welcome to our community.
    That's an odd occurrence for sure, and both of them happen at the exact same time?
    Did you use an online tool to look up the MAC information at all?  That normally will at least tell us who the manufacturer is that had been assigned that set of numbers.
    If you can post the MAC addresses and the timestamps/logs, let's see what we can do to help you with that.
    "There's a fine line between audacity and idiocy."
    -Warden Anastasia Luccio, Captain
  • EricSouth
    EricSouth Member Posts: 3
    First Comment
    1/16/20 at 5:47pm  69:38:E8:C6:31:3A and 93:42:9E:BF:73:14 
     1/15/20 at 5:33pm  9E:16:40:D7:A8:6A and 76:CD:78:F9:35:B0
    12/17/19 at 10:31am CD:FD:98:9D:1F:87 and E4:89:11:4F:96:96
    12/17/19 at 9:38am  DD:48:42:5A:99:84 and 47:A1:37:5C:88:84
    The only thing I know of that is new on my network is a VMware VCSA that I brought up in VMware Fusion on my Mac, but I really don't think that VM was powered on during all these times.   I personally couldn't get any of these MAC's to associate with any brand of hardware.  If you can, please let  me know how you figure it out.    Thank you so much!

  • Robin_Ex_Fing
    Robin_Ex_Fing Member Posts: 5,293
    5000 Comments 250 Answers 500 Likes 100 Awesomes
    ✭✭✭✭✭✭✭
    Hi @EricSouth
    In order to verify if this is being caused by Vmware. Please shut down your MAC and then check if you are still getting those alerts while the MAC is powered off or not?
    Robin (Admin at Fing)
    Getting Started? Please refer to Community guidelines & Community User Guides. HAPPY POSTING!!!
  • kltaylor
    kltaylor Member, Beta Tester Posts: 1,231
    1000 Comments 500 Likes 50 Answers 100 Awesomes
    ✭✭✭✭✭✭
    What I find interesting are the search results for the first two MAC addresses that you provided.

    MAC addresses are designated to specific vendors so that issues like this can be researched.  However, both of those addresses turn up zero results.

    I'll wait until you post the information that Robin asked for, but I think I agree with you on the reasons to be concerned.
    "There's a fine line between audacity and idiocy."
    -Warden Anastasia Luccio, Captain
    [Deleted User]
  • EricSouth
    EricSouth Member Posts: 3
    First Comment
    I can't really shut down my Macintosh, but i did shut down the vmware VCSA that was running in Fusion.  I still don't think it correlates to the times I got the unidentified MAC addresses on FING, but on the other hand I haven't seen any new 'devices' appear on the network since I shut down the VCSA.    As far as I'm concerned we can consider the mystery solved, until I chime back in with some new info.   Thanks for all your help and interest in helping.  Much appreciated
    [Deleted User]