Controller shows unknown 'Known Clients'
Hi @Vincent-TP, already since last year my OC200 controller regularly displays unknown clients in the overview of Known Clients. These all have a MAC Address starting with "C0-A8-0x". I posted about this earlier but unfortunately you where not able to further investigate or assess this. Also see Controller shows unknown 'Known Clients'.
My setup:
- 1 x OC200 v1.0 controller (firmware 1.35.7 Build 20250514 Rel.51837)
- 1 x ER605 v2.0 router (firmware 2.2.6 Build 20240718 Rel.82712)
- 2 x SG2210P v5.20 switch (firmware 5.20.10 Build 20250307 Rel.72554)
- 1 x ES205G v1.0 switch (firmware 1.0.3 Build 20250414 Rel.72933)
- 5 x EAP615-Wall(EU) v1.0 access points (firmware 1.5.0 Build 20240830 Rel. 63168)
- 2 x EAP225-Outdoor(EU) v1.0 access points (firmware 5.1.7 Build 20240819 Rel. 44148)
- 2 x EAP230-Wall(EU) v1.0 access points (firmware 3.2.3 Build 20240815 Rel. 33684)
Even though I regularly "forget" these clients, they keep appearing every now and then. My network is properly secured with ACL's, IP-MAC Binding, etc.
None of these MAC Addresses are known to me. All my (30+) wired clients have a fixed IP address using DHCP Reservation, in combination with IP-MAC Binding. My (also 30+) mobile clients all have a dynamic IP address. I disabled random MACs of my known mobile clients to access my home network, as an extra layer of security using MAC Filter to only allow known clients.
What at least is remarkable is that these all have a MAC Address starting with the same range "C0-A8-01". Obviously, I checked if any of my wired and wireless clients have MAC address that looks similar, which is not the case.
The only thing I can think of is that these are "temporary" (or actual?) MAC addresses of the access points, since many of these have a MAC address starting with the same range ("40-ED-00" for all 5 EAP615-Wall access points and "84-D8-1B" for all 2 EAP230-Wall access points). And yes, I checked if there is any MAC address starting with "C0-A8-01" in the wired client list; there is none. That is why I was suspecting the access points.
Do other users have this as well, and does anyone know what is causing this?
Hi @WM1
Sorry for missing your previous message.
Please go the following page of the controller, and input iwconfig command, and check if there is any similar MAC address in the results.
Or you can send us the results to check.
Please perform the operation on each EAP model individually.
Hi @WM1
Thanks for that info.
One more thing, will these MAC addresses show up on the insight - past connection page? If yes, please check which devices are they connected to via AP/PORT column.
Hi @Vincent-TP, indeed that is where these show up as well. I downloaded the data of this month to sort on username. This is the result:
I added one extra column (yellow) to mention what device is connected to these switch ports.
To further clarify:
- Only Switch 1 and 3 are connected to the Router
- Switch 2 is connected via fiber to Switch 1
- Access Points 1 to 6 are connected to the PoE ports of Switch 1
- Access Points 7 to 9 are connected to the PoE ports of Switch 2
I can confirm sort of the same behavior in my environment.
Port 6 + 7 -> EAP655-Wall(EU) v1.0
The MAC-Adresses of 2,4/5 GHz of EAP (Port6) are
AE:25:4A:84:DB:F4
AE:25:4A:84:DB:F5
The MAC-Adresses of 2,4/5 GHz of EAP (Port7) are
AA:25:4A:84:DB:C4
A2:25:4A:84:DB:C5
If you take a look closly, you can see that the Part 4A-84-DB in the middle of the EAPs MACs are the beginning the the appearing MAC-Adresses.
I have another EAP on Port 4, which have another MAC-Adress Range - but same behavior.
@WM1 Do you have OFDMA enabled?
