Cloned device showing activity (owner not using)

Follow

Ma Ar

• February 06, 2021 03:47

So a device with the same name as brother-in-law showed up on my network for 2 hours downloaded 6 GB in 2 hours (while in quarantine) and then disappeared. Owner of that device was not at residence for the entire time the device was being used.

Best I can think is some locally captured MAC and name of device and then used that information to get access to the network, but curious if anyone else has ideas what this could be?

Why is the quarantine not working?

0

• 

  Firewalla

  • February 06, 2021 06:12

  Firewalla does not just remove devices that quickly.  So, if you look at your device list, you should be able to find it under the "device" button. 

  0

  Comment actions Permalink
• 

  Ma Ar

  • February 06, 2021 14:39

  Not sure that gave me any clues on how to prevent, but if you want an update....there are actually two copies of them now.

  0

  Comment actions Permalink
• 

  Firewalla

  • February 06, 2021 17:33

  If there are two copies of them, look at the MAC address, if they are of the form

  x2:xx:xx:xx:xx:xx
  x6:xx:xx:xx:xx:xx
  xA:xx:xx:xx:xx:xx
  xE:xx:xx:xx:xx:xx

  then it is just the same device, getting private MAC's.  iPhones and some Android does this with private MAC.  And some network extenders will do the same (clone MAC).  

  If you don't believe you own the device, the best way is just to block the device and see who screams. 

  0

  Comment actions Permalink
• 

  Ma Ar

  • February 06, 2021 18:24

  Thanks for the help.

  I know exactly whose phone the entry belongs to, but that person was not here on the date in question and certainly not for 2 hours.

  The device also downloaded 6 GB of data on that date. I haven't seen any activity since then though.

  0

  Comment actions Permalink

Please sign in to leave a comment.