two new MAC's detected at the same time but now IP assigned

EricSouthEricSouth Member Posts: 3
First Comment
Four different times over the past 3 weeks I've had the FingBox detect new devices on the network.  They come in pairs, with identical timestamps.  No IP address is assigned to the new devices.  I can't find any info on the MAC addresses.  They appear to be random.  6 of the alerts came in after hours when nobody was in the offfice.  Any idea what might be causing this?

Answers

  • kltaylorkltaylor Moderator, Beta Tester Posts: 1,191
    1000 Comments 500 Likes 50 Answers 100 Awesomes
    ✭✭✭✭✭✭
    Hi @EricSouth, welcome to our community.
    That's an odd occurrence for sure, and both of them happen at the exact same time?
    Did you use an online tool to look up the MAC information at all?  That normally will at least tell us who the manufacturer is that had been assigned that set of numbers.
    If you can post the MAC addresses and the timestamps/logs, let's see what we can do to help you with that.
    "There's a fine line between audacity and idiocy."
    -Warden Anastasia Luccio, Captain
  • EricSouthEricSouth Member Posts: 3
    First Comment
    1/16/20 at 5:47pm  69:38:E8:C6:31:3A and 93:42:9E:BF:73:14 
     1/15/20 at 5:33pm  9E:16:40:D7:A8:6A and 76:CD:78:F9:35:B0
    12/17/19 at 10:31am CD:FD:98:9D:1F:87 and E4:89:11:4F:96:96
    12/17/19 at 9:38am  DD:48:42:5A:99:84 and 47:A1:37:5C:88:84
    The only thing I know of that is new on my network is a VMware VCSA that I brought up in VMware Fusion on my Mac, but I really don't think that VM was powered on during all these times.   I personally couldn't get any of these MAC's to associate with any brand of hardware.  If you can, please let  me know how you figure it out.    Thank you so much!

  • RobinRobin Administrator Posts: 2,386
    100 Answers 1000 Comments 250 Likes 25 Agrees
    admin
    Hi @EricSouth
    In order to verify if this is being caused by Vmware. Please shut down your MAC and then check if you are still getting those alerts while the MAC is powered off or not?
    Robin (Admin at Fing)
    Getting Started? Please refer to Community guidelines & Community User Guides("Helping Hand"). HAPPY POSTING!!!
  • kltaylorkltaylor Moderator, Beta Tester Posts: 1,191
    1000 Comments 500 Likes 50 Answers 100 Awesomes
    ✭✭✭✭✭✭
    What I find interesting are the search results for the first two MAC addresses that you provided.

    MAC addresses are designated to specific vendors so that issues like this can be researched.  However, both of those addresses turn up zero results.

    I'll wait until you post the information that Robin asked for, but I think I agree with you on the reasons to be concerned.
    "There's a fine line between audacity and idiocy."
    -Warden Anastasia Luccio, Captain
    Ciaran
  • EricSouthEricSouth Member Posts: 3
    First Comment
    I can't really shut down my Macintosh, but i did shut down the vmware VCSA that was running in Fusion.  I still don't think it correlates to the times I got the unidentified MAC addresses on FING, but on the other hand I haven't seen any new 'devices' appear on the network since I shut down the VCSA.    As far as I'm concerned we can consider the mystery solved, until I chime back in with some new info.   Thanks for all your help and interest in helping.  Much appreciated
    Ciaran
Sign In or Register to comment.