How can I show the offline devices on my Archer AX6000 that have connected in the past?
Hi,
I just got a new Archer AX6000 and I'm new to Tp-Link routers.
So far things have been working great, but I do have a concern about an unknown device that seems to keep connecting and disconnecting from my network (I turned on the Online/Offline notification for devices).
The device appears with the generic name: android-65347a971fe7ee86
I can't ever seem to see it actually online when I log in via either the web browser interface or the Android Tether app on my phone.
In my previous router (a different brand), there was a way to show a list of all offline devices that ever connected to your network and you could see their name and IP and MAC addresses when they last connected.
I can't seem to find anything like that in the TP-Link interface and I've searched a lot on Google.
How can I figure out what this device is if I can't get any information about it other than this generic connection name the alert emails me?
Thanks.
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
Some additional info: I turned on the Traffic Monitor in the Advanced section of the System Tools and I can see all my known devices and their upload/download values.
However, this unknown android device doesn't show up in the list of devices and yet just a few minutes ago I got a disconnect and then 13 minutes later another connect.
It's done this twice today in the last 12 hours since I turned on the notifications. I can't figure out what could be doing it as I know all the hardware that is powered on and connected to my network except this. Could this be the router itself?
Maybe some internal OS process that wakes up every now and again and then shuts down over and over? Anyone have any ideas how to log/track/monitor/diagnose all the technical details of what this is?
Thank you.
- Copy Link
- Report Inappropriate Content
Does it mean this device is not showing up anywhere including the DHCP client list, ARP List, Binding List?
What if you change the wireless network name as well as the password for both the 2.4G and 5G, reboot the AX6000, will you still get the notification of this unknown device?
- Copy Link
- Report Inappropriate Content
@Kevin_Z Thank you for replying Kevin. It does not show up in the DHCP client list. I don't see any way to view the ARP list or Binding list from the Advanced Tp-Link web admin pages.
I admit I'm only intermediately knowledgeable regarding networking stuff as it's not my day job although I have had training in it many years ago.
I don't want to change the network name or the password on the wireless network as this router is replacing a different brand router and I didn't want to have the hassle of re-entering all the passwords for all my devices again.
But on a reboot of the AX6000 this unknown device did send me a notification it connected.
In the System Log I see "ARP Binding disabled" so that's some default setting as I have not touched anything to do with this.
I wish it would give me an IP and/or MAC address when it re-connected, but I only get the email or push notification from the Tether app with the device's supplied name (I'm guessing).
- Copy Link
- Report Inappropriate Content
You may find the ARP list on the router's Advanced->Security->IP & MAC Binding page.
If you cannot find this unknown device, I'm afraid we need to capture the router log via Wireshark to further analyze, as there is currently no such feature as you requested on the router.
Let me know if you would like to further troubleshoot this issue, thanks.
- Copy Link
- Report Inappropriate Content
@Kevin_Z Thank you Kevin. I see the ARP list in that security page. However, I do not see this unknown device there.
The connection pattern for this device is very strange. Here's the list of emails and the timing I've received so far today:
Date/Time Event
------------- --------
Mon., Dec. 7 at 9:12 p.m. CST Connected
Mon., Dec. 7 at 10:01 p.m. CST Disconnected
Tue., Dec. 8 at 6:06 a.m. CST Connected
Tue., Dec. 8 at 6:36 a.m. CST Connected
Tue., Dec. 8 at 6:43 a.m. CST Connected
Tue., Dec. 8 at 8:17 a.m. CST Connected
Tue., Dec. 8 at 11:10 a.m. CST Connected
So far I haven't seen it logged in the Traffic Monitor. I turned on the Traffic Monitor last night at about 8:00pm CST.
The only thing unusual in the Traffic Monitor that I can't account for with all my devices is this:
IP Address: 192.168.0.200 with MAC Address: 00-00-00-00-00-00 that had 1.47 KB downstream and 0B upstream.
This happened only one time during the Mon. Dec 7 @ 9:00pm to 10:00pm CST hourly window (it's too late for me to show the minute intervals now).
The only idea I had is that maybe this is my FitBit Sense watch that does have a wi-fi connection that I set up a while ago but that is not really in use since it only works when sync'ing music for Pandora or Deezer (which I don't have) or updating the device with new apps (which I haven't done lately).
I will attempt to do some kind of action to force the FitBit to use the wi-fi and see if it logs anything.
Other than that, as you suggested I did just install WireShark (I have used it a couple of times in the past, a few years ago) so I'll see if I can monitor the packets on my network to see what this might be.
It's odd the unknown device keeps sending Connected alerts but rarely sends Disconnected alerts when I have both turned on.
Regards,
Andre
- Copy Link
- Report Inappropriate Content
Hi Andre, thanks for getting back with all the detailed info. Is it possible that this unknown devices with the special MAC address is a virtual MAC of one device in the network? I just wonder if there is any range extender or repeater in the network which may show up with a virtual MAC address?
It is great to know that you can run WireShark and monitor the logs, you may share your finding later with the community, good day.
- Copy Link
- Report Inappropriate Content
Hi Kevin. So, I found out what the android-65347a971fe7ee86 name connects to.
I did this by recording all the known devices with their IP address and their MAC address from the DHCP list and the Network Monitor.
Then I noticed that in the Tether app when you go to add a new Known Device Alert, the selection list shows the device name and the MAC address underneath.
Well, it turns out this odd android name has a MAC address that matches my Samsung Galaxy Tab S1 tablet (which is still running Android 6 as it won't update any more).
What's odd is the tablet keeps reverting back to the 2.4 GHz band even though I connect it to the 5GHz manually in the settings.
I am only 5 feet away from the router so both bands are as high as they can be, so why would the router and/or tablet keep wanting to switch back to the 2.4 GHz band?
The tablet didn't do this before with my previous router (different manufacturer but only 4 years old and a dual band AC2600 MU-MIMO capable unit).
I noticed that when it switches bands, I get both a disconnect and then a re-connect alert (and just now a second re-connect alert consecutively 3 minutes apart from the first connection alert after the band switch).
So at least I'm satisfied I know about all the devices connecting, but I don't like that the band is switching automatically even though I don't have the "Smart Connect" feature on the router turned on and I have separate SSIDs for both bands.
I have no idea what the 00-00-00-00-00-00 MAC address is all about as I have no range extenders or repeaters on my network. It's a cable modem from my ISP in bridge mode connected to the Archer and that's all.
The only small bit of info I could find out on Google was that this may be a broadcast type of message from the router itself looking for the actual MAC address of a device or something like that.
I do notice that my Galaxy Note 10 phone running Android 10 gives out a new MAC address every time I change the router settings since it thinks it's a new network and the OS now generates a virtual MAC. I have 5 different MAC addresses for this phone listed in the Known Device Alerts list.
The router does not get the true physical hardware MAC address of my phone even though apparently there's a way for software to request the device provide the real hardware MAC if it is hiding it with a software generated version.
- Copy Link
- Report Inappropriate Content
Generally, the AX6000 will determine which band is best for the device to use when Smart Connect is enabled, thus your Samsung Galaxy Tab S1 tablet may accept it and swift the connection. However, as you mentioned, the Smart Connect is disabled on the AX6000, so this should not happen. From what I can tell, it seems that this Samsung Galaxy Tab S1 tablet would prefer to connect to the 2.4G rather than the 5G as per your description, no matter what is the distance.
- Copy Link
- Report Inappropriate Content
Information
Helpful: 0
Views: 2079
Replies: 8
Voters 0
No one has voted for it yet.