Espressif Inc ESP32 or ESP8266 Wireless devices shown as WIRED in Omada
GW is ER7206 v1.0 1.4.1
Devices appear as WIRED, but cannot be. Seem to be IoT devices. They go to sleep and reappear. Some coming back with different last three octets. MAC ID lookup comes back as Espressif Inc, likely ESP32 or ESP8266. No data is recorded as transferred, which seems unlikely as these (likely) automation devices do contact their command and control server. Some devices that show up wired but show data transfer use spoofed Mac Addresses. While I cannot say that there are detrimental effects (not sure... Omada system has other hickups), perhaps this suggests a need to categorize and identify these devices uniquely? Handle them differently? They are showing up as wired to the GW or to a SWITCH. Filling up the Known Clients list! Some devices do show up with data transfered, but MAC ID comes back as unregistered. Can't block them either since they change or spoof MAC ID.
For lack of an IoT category, I'm OK leaving these in WIRED for now... rather than wireless. Just thought I'd bring it up for awareness.
Under DEVICES, the MAC ID shows up in the client group of the SWITCH. This snapshot is of an SG2008P switch, showing wired client connected to port 3 which feeds an EAP655. "Wired" client does not show up under EAP. Connectivity diagram shows same.
F4-4F-C6-1E-C8-F6; F4-4F-C6-1E-8A-3B; F4-4F-C6-1F-FE-AB;
@Vincent-TP Not illegitimate that I can see. There is one MAC Address that belongs to an HIK Vision license plate camera that is wired into a MESH connected EAP225 Outdoor. This shows an IP address assigned. Correctly, it does NOT show up on the Mesh EAP's wireless client list. The wired camera shows up under the switch port that feeds the host EAP to which the remote mesh connected EAP is linked. Attached is the CSV Wired Clients export. A few legitimate wired devices will be evident.
98-F1-12-8E-83-73 is the HIK Vision Mac ID. It shows connected to Switch port 3, which is PoE powered EAP225 Outdoor. 
Port 3 is assigned to and powering:
Can't seem to upload the Omada generated CSV wired client export. Here is a screen shot....
As noted in the original post, this F4-4F-C6 device is showing originating through Dom2 Switch Port 3 which is an EAP. I have visually confirmed there is no other physical/wired Ethernet cable attached to this EAP. Seems I must inquire what this spoofed device could be and if anyone has brought a new piece of automation or ??? to solve this mystery.
Check out the activity sample and how this spoof comes and goes ...
@Vincent-TP Thanks for opening the ticket.
As stated above, the "Wired" device shows up under SW2 port 3 which is connected to the EAP655. You can see when it was last rebooted under uptime.
I rebooted only the EAP655 now. The ghost device disappeared while the EAP655 was rebooting. Upon EAP reconnection, that ghost device did not immediately reappear. Nor did I see it connecting through any other EAP in the clients list.
2 minutes after the EAP655 reconnected (uptime 7m), the ghost device showed up again (uptime 5m).
I have downloaded the device info.zip file if you need it.
