Unrecognised network infrastructure device.

I'm looking for advice on what to do about a device that I see listed under Infrastructure Devices on my network when I look in Windows Explorer. I can't identify it and wonder if my system is compromised in some way. A few days ago I had a series of several mobile phones and an Amazon tablet appear and then disappear again. When I view the properties I see:-

Device details
Manufacturer Mini-Router
Model RTL8xxx
Model Number EV-20 10-09-20
Serial Number 123456789012347
MAC Address 0e:41:58:00:99:3c

I have got a WD MyCloud NAS, 2 x security cameras, Sky Box, Sony Smart TV, HP Printer, iPhone, iPad and my desktop PC connected at various times. I have 2 x TP link switches each connected directly to the router.

The iPhone, iPad and PC are connected by Wi-Fi on 5GHz and my router 2.4GHz is disabled. I've setup MAC filtering to allow only those 3 devices to connect. I've also changed my Wi-Fi password.

Has anybody got any idea what the unknown device might be and what I should do about it?

p.s. I should add that my router is a Netgear R6250 (802.11ac Dual Band Gigabit)

Edited by longedge (Thu 28-Dec-17 14:01:03)

That's a Realtek wireless lan adapter. What wifi adapter does your desktop have?

Thanks for the speedy reply.

My PC wireless adapter is shown in device manager as "Qualcomm Atheros AR938x".

There appears to be a wireless adapter in something on your network that is a realtek. The PC doesn't by any chance have an old inbuilt wireless adapter that you aren't using does it? Or perhaps one of your neighbours knows your wifi password and is accessing your Internet?

I wsas thinking along those lines which is why I changed my wireless password. However, my router doesn't show it as a connected device.

I think my next step is going to be finding a lead long enough to connect my PC by ethernet and disabling wireless altogether and then see if it re-appears.

This appears to be a feature of Windows 10 and perhaps 8, in that Windows Explorer reports wireless devices that aren't actually connected to your network. For example I frequently notice phones being listed in Windows Explorer when running Win 10 with a wireless connection that are not connected to my network/WAP/switches nor seen by Win 7.

The thing is that it keeps disappearing and then re-appearing. I just checked again and it was gone. I refreshed the view 5 mins later and it was back.

Download and run Netscan, if the device has an IP address on your LAN, you have a problem. How are your security cameras connected? Generally, domestic variants are easily hackable.

Disable WPS on your wireless router. This may be a sign of a WPS attack tool. Also make sure that you're running the very latest firmware as the R2650 has had a number of serious vulnerabilities.

The fact you're seem to be seeing other devices connecting suggests that one of your neighbours is using your wifi.

I'd suspect that the device you keep seeing is the device trying to brute force attack your WPS pin number and, once cracked, this can be used by other devices such as the Amazon tablet and mobile phones you saw previously.

Edited by caffn8me (Fri 29-Dec-17 10:17:08)

That was pretty much the conclusion that I came to (PixieDust). I haven't seen the device yet today. I'm waiting for delivery of a 5metre cable and as soon as it arrives I can connect my PC and then I'm going to switch wireless off altogether for a few days. Everything on my network will then be hard wired except my iPhone and iPad and I can manage without them being connected.

p.s. I have updated my router with the latest beta security patch.

Edited by longedge (Fri 29-Dec-17 12:33:33)