Hi  @daubstep 

 

Thank you for posting. If you search the MAC address on the client list or Logs page, will there be any results?

What EAP you are using? Are they EAP-wall series? If so, are there any wired devices plugged into the ETH ports of the EAP-walls? You may check if the MAC is same as one of those clients(if any).

It's also possible that it could be a device that is misbehaving or perhaps a component within the network infrastructure that is being misidentified.

 

As it never requests an IP address and has very little traffic, it might be a device that is not properly configured or a malfunctioning component. I recommend checking the cables connected to ports 1 and 4 to ensure they are properly seated and not damaged.

You could also try power cycling the switch and the EAPs connected to those ports to see if that resolves the issue. 

  @Vincent-TP Thanks for the suggestion to check the logs, I hadn't been looking at event logs and they are helpful - it's odd how this mac address (that shows as from TP Link's allocation: https://macaddress.io/mac-address-lookup/x5DXywn056) bounces around appearing as if connected to either one of two EAPs (A 772 and a 683-LR) or wired via the SG2210MP that both of these EAPs are connected to upstream):

 

I don't (currently) have any wall EAPs deployed and these two EAPs are directly wired with solid connections to the upstream switch. I guess I will try rebooting next, but will have to wait for a time nobody will yell about (both are PoE via the switch, so cycling that switch should restart everything).

 

Does TP-Link have a way to do more granular MAC address lookup to see what type of device this address is likely to be coming from?

  @daubstep, Over the last few years of using this system, I've noticed similar behavior.  Do you have your EAP's configured for mesh capability?  Each EAP has multiple MACs due to the different BSSID's they can have and use for failover and connecting to each otherl.  It drove me nuts for almost a week, until I started seeing in the logs and digging around in the  that the mac-addresses were technically being used when I had two or more access points as part of a bridge/mesh.  

 

If you go to "Device List" and then select "APs" to narrow down your devices. Make sure you have the view of the "BSSID" column by selecting it from the elipses in the upper right hand corner which lets you modifiy what columns are visible you will see the BSSID associated with each access point.  If you hover over the BSSID column for a specific access point you will see multiples, depending on the amount of radios your AP has.   From there, I manually made DHCP entries so that when I saw those MACs in the future I knew it was one of the BSSID's and not some rogue device.  See the screenshot below which will hopefully clear up what I'm saying.

 

 

 

I do wish as part of the mesh system I could pick and choose which AP's I could include in the mesh network, as I use some AP's for infrastructure (bridges), and others just for users access.

Hope this helps.

Cheers!

  @Zeus7 Woah, thanks for this info - it is definitely useful and good to know (and should really be handled much better natively), BUT, unfortunately this seems not to solve my mystery, as the rogue mac address (showing up as wired directly to my switch and not wirelessly connected at the moment, though that is sure to change again soon) does not show up as any of my APs' BSSIDs... I cannot find this mac address anywhere else on the network - the mystery continues...

 

@Vincent-TP are you able to look up what type of TP-Link device this mac address would be found on? "54-AF-97-70-D5-BA"

Hi, I tried searching and found that it's a Smart Wi-Fi Plug Mini.