Identifying DHCP clients

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

Identifying DHCP clients

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Identifying DHCP clients
Identifying DHCP clients
2021-01-25 16:03:45

Personal background - just retiring from a 40 year career in IT, so have more than 'consumer' knowledge of networking, but networking was not my lane. I'm no network engineer.

 

For several years I  have had a TP-Link wireless router.  In identifying it for this thread, the label on the front says AC1750.  When I open the admin page (192.168.0.1) the Status page reports '

Hardware Version:
Archer C7 v2 00000000

 

My question is how to identify the devices listed under DHCP clients.  Some of them have names that are obvious, one has a name that is meaningless to me, and several are reported as 'Unknown'.    And there are more devices than I can account for.

 

I thought that I could match on MAC address, but interestingly when I check the MAC address of a 'known' device, the last two or three octets match what is reported by the router, but not the first few. I was able to match/identify our cell phones by checking the phone's settings for it's IP address.  But that still leaves me with three "Unknown' devices unaccounted for, and one device named simply 'RE200'.  And I only have one actual device that I can think of that I have not accounted for on the list.  That would be a network extender device.

 

 

So, questions:

1) Any idea how to identify and account for the unidentified devices?

2) why do the MAC addresses only match on the last few octets?

3) is there any way to bind the MAC address (as known to the router) to a 'friendly' name?

  0      
  0      
#1
Options
7 Reply
Re:Identifying DHCP clients
2021-01-25 22:11:35

 

stuckyville wrote

 
Hardware Version:
Archer C7 v2 00000000
.

So, questions:

 

1) Any idea how to identify and account for the unidentified devices?

2) why do the MAC addresses only match on the last few octets?

3) is there any way to bind the MAC address (as known to the router) to a 'friendly' name?

@stuckyville 

 

Well, your Manual might help, but I'll also try...

 

1) The IS tough but can be done. One way is TURN OFF the devices one by one and see what 'disappears'. Tricky part it #3 at this point, I'll cover that later.

2) Some devices have more than one used. I'm not sure what you mean though, and example might be of help and maybe I could explain it as well if I knew the name. I suggest you Google "mac address lookup vendor" and you will find many sites that you can PASTE in from the router GUI DHCP Server page. One correction though, it is the FIRST 3 Octets that determine the vendor, not the last ones.

3) Well, that depends on the router? In my case, and probably many other routers (I've got an Archer A20) I have to use Tether and I can select a Client from the Client List and then edit the name. Problems can occur if you have many of the same devices. Some router's I've used will 'grab' a name from the device, others will use some sort of name that might give you a clue (like the RE200) and some will be completely wrong.

  0  
  0  
#2
Options
Re:Identifying DHCP clients
2021-01-26 01:53:17

@IrvSp 

regarding MAC address differences, here's an example.

When I look at the properties of my Android cell phone it reports the following:

 

IP Address

fe80::58ce::76ff::fe62::902a

192.168.0.110

 

Checking the client list on the router, I see that IP address 192.168.0.110 is associated with MAC address ' C4-25-E9-62-90-2A '   Now, given the difference in formatting the address, they appear to be the same beginning with '62' 

 

 

  0  
  0  
#3
Options
Re:Identifying DHCP clients
2021-01-26 11:18:13

 

stuckyville wrote

@IrvSp 

regarding MAC address differences, here's an example.

When I look at the properties of my Android cell phone it reports the following:

 

IP Address

fe80::58ce::76ff::fe62::902a

192.168.0.110

 

Checking the client list on the router, I see that IP address 192.168.0.110 is associated with MAC address ' C4-25-E9-62-90-2A '   Now, given the difference in formatting the address, they appear to be the same beginning with '62' 

 

 

@stuckyville 

 

Well, no, that is not your MAC Address, but your IPv6 address smiley. Format is completely wrong for a MAC Address.

 

See https://www.geeksforgeeks.org/introduction-of-mac-address-in-computer-network/ for details.

 

Giveaway that this is a IPv6 address is the "::", which is used to indicate a string of 4 zeros, see this page for the IPv4 and IPv6 formats, https://www.ibm.com/support/knowledgecenter/en/STCMML8/com.ibm.storage.ts3500.doc/opg_3584_IPv4_IPv6_addresses.html.

 

Now here is my IPCONFIG /ALL output (on Windows 10):

 

---------------------

Wireless LAN adapter Wi-Fi 2:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek 8814AU Wireless LAN 802.11ac USB NIC
   Physical Address. . . . . . . . . : 80-3F-5D-14-92-C2
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2603:9001:4802:b1ce::1004(Preferred)
   Lease Obtained. . . . . . . . . . : Tuesday, January 26, 2021 5:34:38 AM
   Lease Expires . . . . . . . . . . : Wednesday, January 27, 2021 5:34:37 AM
   Link-local IPv6 Address . . . . . : fe80::d0b:630b:7630:1b7f%16(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.0.166(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Tuesday, January 26, 2021 5:34:33 AM
   Lease Expires . . . . . . . . . . : Thursday, January 28, 2021 5:34:33 AM
   Default Gateway . . . . . . . . . : fe80::52d4:f7ff:fe68:3cc4%16
                                       192.168.0.1
   DHCP Server . . . . . . . . . . . : 192.168.0.1
   DHCPv6 IAID . . . . . . . . . . . : 612384605
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1D-04-98-17-F8-B1-56-DD-6A-5B
   DNS Servers . . . . . . . . . . . : 2606:4700:4700::1111
                                       2606:4700:4700::1001
                                       192.168.0.1
                                       192.168.0.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

=====================

 

80-3F-5D-14-92-C2 is my MAC Address. This is a 'cheap' USB 3.0 Wireless AC 1300 Network Adapter. It was made in China, and the MAC Address is used by a Chinese company.

 

To see your Android Phone MAC Address you need to go to Settings -> System -> About phone -> Hardware Info and it is listed there.

 

 

This compares to my DHCP Client list on the router:

 

 

I am connected to the router with this MAC Address and assigned an IP Address in the Router as this:

 

As you can see, the PHYSICAL ADDRESS in IPCONFIG matches the network adapter's MAC Address.

 

It seems to be a coincidence that they have a common ending. Mine certainly do not.

 

  0  
  0  
#4
Options
Re:Identifying DHCP clients
2021-01-26 14:49:07

@IrvSp 

Seems not all Android phones are created equal.  Under Settings > System, I have

- Languages & Input

- Gestures

- Date & TIme

- Backup

- Reset Options

 

I do have 'about phone' directly under System, but with that I have, among other obviously unrelated things:

- Model & Hardware

--- Model

--- Serial number

--- Hardware version

--- Model Number

 

- Hardware Information

--- RAM size

--- ROM size

--- Display

--- Camera

--- NFC

 

Further down, it does list a 'Wi-Fi MAC address, but that does not come close to the address shown in the router's client list.

  1  
  1  
#5
Options
Re:Identifying DHCP clients
2021-01-26 18:25:12

@stuckyville 

 

I think the clue would be your mention of the RE200 extender.

 

Devices that connect through it have their MAC address changed. So the first half is different which seems to match what you are seeing.

 

So if you were to bypass your extender or simply turn it off, you should then see matching MAC addresses.

 

The extender does this to try and maintain as much universal compatibility with any networking router.

  0  
  0  
#6
Options
Re:Identifying DHCP clients
2021-01-26 18:43:36

@stuckyville 

 

Yeah, some versions of the OS could be different as well which is your Cell Phone company as they also change settings.

 

Under the WiFi it is the MAC address of 'who' is providing the signal, not your device, at least on some devices. On my Phone, they DO match the value on the DHCP Server entry for my phone. For instance, on my iPad, I get 2 different MAC Addresses, one under Wifi and another under General, both labeled WiFi Address. The one under Wifi itself matches the router DHCP client list. The one under general matches the Router MAC Address.

 

Each it seems is different and you've got to discover  which is which, might be documented in the Device Manuals? Never bothered me though.

 

Still, you were looking at the IPv6 IP address, not the MAC Address.

 

By the way, on my Archer A20, each of the Tri-band SSID's have a different MAC Address, all from one device.

 

 

I only mention this because if you have Smart Connect enabled vs. assigning each device to a specific SSID, it you were to look at the device and what it was connected to MAC Address, that could change on you from the last time you looked (switched for 2.4Ghz to 5Ghz band for instance, last digit would change, see above).

  0  
  0  
#7
Options
Re:Identifying DHCP clients
2021-01-26 22:21:47

@IrvSp 

 

Regarding confusing the IPv6 address with a MAC -- all I can say is a Homer Simpson "DOH!".  After all, it was labled 'IP Address'.   blush

 

I don't know if the RE200 is the extender or not.  I'm just guessing that.

 

I think this all give me a better idea of it all.  I'm still puzzeled by the fact that it show three more clients than I can account for with all of my devices.

 

But it may soon be moot, or back to the beginning.  I'm giving serious consideration to upgrading my modem, and replace the router with a tri-band mesh.

 

Thanks for your time and assistance.

  0  
  0  
#8
Options