Controller shows unknown 'Known Clients'

Controller shows unknown 'Known Clients'

Controller shows unknown 'Known Clients'
Controller shows unknown 'Known Clients'
2024-08-05 09:03:36
Model: OC200  
Hardware Version: V1
Firmware Version: 1.31.3 Build 20240620 Rel.80383

For some time my OC200 controller regularly shown unknown clients in the overview of Known Clients. These all have a MAC Address starting with "C0-A8-01":

 

 

My setup:

  • 1 x ER605 v2.0 router (firmware 2.2.6 Build 20240621 Rel.03066)
  • 2 x SG2210P v5.20 switch (firmware 5.20.2 Build 20240531 Rel.65965)
  • 1 x OC200 v1.0 controller (firmware 1.31.3 Build 20240620 Rel.80383)
  • 5 x EAP615-Wall(EU) v1.0 access points (firmware 1.2.4 Build 20240312 Rel. 38105)
  • 2 x EAP225-Outdoor(EU) v1.0 access points (firmware 5.1.6 Build 20240313 Rel. 43415)
  • 2 x EAP230-Wall(EU) v1.0 access points (firmware 3.2.0 Build 20240103 Rel. 66363)

 

Even though I regularly forget these clients, they keep appearing every now and then. My network is properly secured with ACL's, IP-MAC Binding, etc.

 

Do other users have this as well, and does anyone know what this causing this?

  0      
  0      
#1
Options
7 Reply
Re:Controller shows unknown 'Known Clients'
2024-08-06 02:42:53

Hi  @WM1 

 

What kind of devices are these MAC addresses for?

Are they the real MAC addresses of the clients?

 

  0  
  0  
#2
Options
Re:Controller shows unknown 'Known Clients'
2024-08-06 06:14:24 - last edited 2024-08-06 06:14:34

Hi @Vincent-TP, good question.

 

I forgot to mention that none of these MAC Addresses are known to me. All my (30+) wired clients have a fixed IP address using DHCP Reservation, in combination with IP-MAC Binding. My (also 30+) mobile clients all have a dynamic IP address.

 

What at least is remarkable is that these all have a MAC Address starting with the same range "C0-A8-01". Obviously, I checked if any of my wired and wireless clients have MAC address that looks similar, which is not the case.

 

The only thing I can think of is that these are "temporary" (or actual?) MAC addresses of the access points, since many of these have a MAC address starting with the same range ("40-ED-00" for all 5 EAP615-Wall access points and "84-D8-1B" for all 2 EAP230-Wall access points).

 

Does this explain it somewhat better?

  0  
  0  
#3
Options
Re:Controller shows unknown 'Known Clients'
2024-08-06 07:57:44

Hi  @WM1 

These should not be the MACs of the APs.

 

Normally, wireless clients will choose to use random MACs to access the network for privacy protection, We suspect that these are the random MAC addresses used by the clients.

Did you check if there is any MAC address starting with "C0-A8-01" in the wired client list?

  0  
  0  
#4
Options
Re:Controller shows unknown 'Known Clients'
2024-08-06 20:12:48

Hi @Vincent-TP, thanks for your response.

 

I disabled random MACs of my known mobile clients to access my home network, as an extra layer of security using MAC Filter to only allow known clients. Tomorrow I will check if any of the mobile clients accidentally is using a random MAC address. That would explain it. I will let you know.

 

And yes, I checked if there is any MAC address starting with "C0-A8-01" in the wired client list; there is none. That is why I was suspecting the access points.

  0  
  0  
#5
Options
Re:Controller shows unknown 'Known Clients'
2024-08-07 01:45:04

Hi  @WM1 

 

You may also search the MAC on the Logs page, There will be a log if a client ever connects, and it will also show which device it is connected to, wired or wireless.

  0  
  0  
#6
Options
Re:Controller shows unknown 'Known Clients'
2024-08-12 19:20:13

Hi @Vincent-TP, l checked if any of the mobile clients accidentally is using a random MAC address. That seemed not the case. At the same time, no new registrations of unknown 'Known Cients' happened. I will keep an eye on it i the coming days. Thanks so far.

  1  
  1  
#7
Options
Re:Controller shows unknown 'Known Clients'
3 weeks ago - last edited 2 weeks ago

Hi @VincentTP, meanwhile the MAC Addresses starting with the same range "C0-A8-01" in the overview of Known Clients of my OC200 controller has increased to 23:

 

C0-A8-01-0D-01-BB
C0-A8-01-1D-01-BB
C0-A8-01-1E-00-35
C0-A8-01-1E-01-BB
C0-A8-01-20-00-35
C0-A8-01-20-01-BB
C0-A8-01-22-01-BB
C0-A8-01-23-01-BB
C0-A8-01-26-00-35
C0-A8-01-28-01-BB
C0-A8-01-2A-00-35
C0-A8-01-2C-01-BB
C0-A8-01-2D-01-BB
C0-A8-01-2E-00-35
C0-A8-01-FE-D3-80
C0-A8-01-FE-E1-17
C0-A8-01-FE-E7-AE
C0-A8-01-FE-E9-B0
C0-A8-02-02-8C-12
C0-A8-02-02-AF-52
C0-A8-03-04-00-35
C0-A8-04-02-00-35
C0-A8-04-03-00-35

 

 

As you can see in the screenshot there is '0' KB/MB/GB of DOWNLOAD and '0' KB/MB/GB of UPLOAD.

 

As mentioned earlier, l checked if any of the mobile clients accidentally is using a random MAC address. That is not the case.

 

Can I ask you to investigate this? Thank in advance.

  0  
  0  
#8
Options