Intrusion, MAC adress detection

laurent
laurent Member, Beta Tester Posts: 3
First Comment First Anniversary Photogenic
edited July 14 in Devices & Security
Hello, My fingbox has detected new MAC addresses on the network (Ethernet or WIFI), is it possible to have more information on this intrusion? For example knowing if the MAC address is a sister of a real card.

Answers

  • Marc
    Marc Moderator, Beta Tester Posts: 2,577
    100 Answers 1000 Comments 500 Likes 250 Awesomes
    ✭✭✭✭✭✭
    There are utilities out there that allow you to plug in a Mac address and they can respond with the manufacturer of the network interface card.  That will sometimes point you to the device in question.  https://dnschecker.org/mac-lookup.php is one of them...
    Thats Daphnee, she's a good dog...
  • laurent
    laurent Member, Beta Tester Posts: 3
    First Comment First Anniversary Photogenic
    thanks, but it's only for real card. No for virtual card.
  • Marc
    Marc Moderator, Beta Tester Posts: 2,577
    100 Answers 1000 Comments 500 Likes 250 Awesomes
    ✭✭✭✭✭✭
    What some folks have done to figure it out is to disable the network device by device while pinging till it no longer responds.  

    I know its kludgy but they built the concept of virtual addresses so a device cannot be easily identified.
    Thats Daphnee, she's a good dog...
  • laurent
    laurent Member, Beta Tester Posts: 3
    First Comment First Anniversary Photogenic
    It's difficult because in fingbox log i see it only 1min

    2021 Jul 14 10:20 38:2B:39:6E:1C:1C left the network
    2021 Jul 14 10:20 5C:43:D1:3F:5B:FF left the network
    2021 Jul 14 10:19 38:2B:39:6E:1C:1C entered the network
    2021 Jul 14 10:19 5C:43:D1:3F:5B:FF entered the network
Sign In or Register to comment.