Unknown "Computer" devices with windows "not in network"

pkirsche

Hello Fing-Community,

after analysing and messing around with a strange behavior of my fing box I am now at a point where I don't know any further.
Since a few month, several unknown devices appear on my network (LAN and WIFI) which are identified as "Computer" running "Windows".
The devices itself don't seem to be connected to my network, none of them has ever had a correct IP-address, they are showing up in fing with these details (one of the several entrys as an example) 

IP address: not in network
MAC address: 00:65:8B:90:09:2C

Other devices are having MAC addresses like:

00:CE:4D:7E:A6:B7
00:E5:8F:FA:B0:31

If I check these MAC address, it only tells me that its an unknown OUI. So I assume these MACs are randomly generated.

New devices appear multiple times a day and are filling up my network device list. Only workaround actually is to block new devices per default by fing. But this leads to a mail and notification for every of these ghost devices when they are blocked. I don't want to disable notification at all as this is one of the major features to tell me about "real" new devices on network.


I already resetted my fingbox, deleted the network, used another ethernet cable but none of that did make any differences. 
Day after day I have to delete these unknown devices.

Has anyone else this issue with fing? Is there any solution or idea?
Help is much appreciated.

Thanks!!

Chandrahas

Hi,

This does not seems like issue with fing, I had same issue with my wife OnePlus. most of new phones (including Android) have feature of showing random MAC when connecting to WiFi and this can be changed in setting. This must be some innocent cellphone. Whenever it reconnect with new MAC, old one becomes not in network.

pkirsche

Hello and thanks very much for your answer. 
Indeed, the newly MAC randomisation of modern devices like Android and iPhones was one of the points that came into my mind while analysing this behavior.

Unfortunately, I found some major differences between devices with that functionality (I also own devices which use "fake" MACs) and the random devices that were detected by fing.

These are the major differences I found out:

- Devices using these annonymous functions ARE on my network, receive IP addresses and were sometimes shown with their manufacturer. But never as "Windows" devices or even unknown devices.
- These suspicious unknown devices never asked for an IP address on my router, I think fing is correct here labeling them as "not on network". But there must be any point of connection where these devices didn't get into my network (no DHCP request, no IP, no connectivity) but were recognized by fing.
- the high frequency these devices are beeing detected by fing is also different from devices like my android which uses these annonymous function but is then solid bound to my network and also idenfified later on.

In the time I wrote my first post and my reply now I got another batch of three new "unknown" devices mentioned as "Computer" with "not in network" and without IP address.

Interesting point, one of these devices is shown as "generic" instead of "Computer" and has a MAC 00:80:BF:7F:17:CB . This MAC resolves to "TAKAOKA ELECTRIC MFG. CO. LTD." and I am quite sure that there is not a device around from this manufacturer. As it is not "in my network" I also have no chance to analyse anything on network level.

Last but not least, I am also convinced that this is not a "bug" or false-detection of fing, but I just don't know where to start from with my analysis.

These devices never got "into" my network as far as I can say, but they are, somehow, detected by fing.
If there would be an option in fing to just ignore devices that are "not in network" than this would solve my issue (well, workaround it).

One point last, I live in germany so my fing app is set to german. Maybe some parameters are called different in englisch language, I am trying to translate as best as I can

Any further ideas?

Joer

Do you have IPV6 turned on in your network? In my experience, my known devices, working just fine would show as "not in network" if they were using IPV6. Unfortunately, Fing hasn't caught up with IPV6 yet so they recommend disabling it for your network. I tried and Fing seems much happier. Not a good strategy though.

pkirsche

Good Point wizh Ipv6, but Ipv6 is disabled in whole network, router is ipv4 only and provider assigns only ipv4 on wan.

I disabled Ipv6 on wlan after your post additional, but just got another new unknown device :(

Chandrahas

Do you have any Virtual Machine running on any of your computer? (Like virtualbox, hyper-v, VMware) virtual machines can also show up on network.

Scooby

As you have a Fingbox, is it possible the notifications are from the DigitalFence feature? (I do not own a Fingbox).

https://help.fing.com/knowledge-base/digitalfence-feature/

pkirsche

Hello again together, please excuse my late response, I wasn't at home the last days.

"Do you have any Virtual Machine running on any of your computer? (Like virtualbox, hyper-v, VMware) virtual machines can also show up on network."
Yes, I have a small server running esxi with some VMs, I immediately checked these VMs and the setup and found, that fing is correctly identifing these devices as "VMWare / Workstation pro" and also is showing me all the information like IP address and manufacturer details. 

"As you have a Fingbox, is it possible the notifications are from the DigitalFence feature? (I do not own a Fingbox)."
Great feature, I always asked myself how fing can tell me about devices not able to join the network
This feature sounded like it was the solution as this would explain the "not on network" information.
But then I checked the fing event log and it showed me some devices which have been found nearby as "in area". Unfortunately this differs from the information of my "ghost devices", as they aren't shown as "in area" in eventlog.

I am now some steps closer to the issue and also it "disappeared", but I am not sure what was causing it.
These are the steps I did (in case someone else faces this problem in the future):

- deactivated wifi completely and checked it these ghost devices still appear in network. -> no more devices appered!
So the issue seems to be related to the wifi part of my network.
- changed wifi password and reactivated wifi again (but did not reconfigure my clients in first step).

I left the nework without clients for a day and checked if new ghost devices appeared -> no ghost clients.

- now I reconfigured device per device with the new wifi password and always rechecked if the ghost devices appear again.

In the end I now have all devices back again in my network but fortunately no ghost devices since two days.

So in short, changing the wifi password solved the issue.
It could come in mind that my password was compromised, but I used a very very strong and complex passwort. Thats why I doubt it was hacked.

Maybe it was caused by a D-Link wifi powerswitch, which behaved a bit strange as my Pixel phone was connected to my home wifi via this D-Link device during setup. Sounded a bit like a passthrough AP function to me. I just left this device out if the network.

I will monitor the situation and check if the ghost devices keep staying away (hopefully).
If not or if I get some new findings, I'll report here.

In the meanwhile, thanks to all repliers and readers for their attention and help. Thanks very much!