MAC address

I have been looking at my father-in-law's network and there is a device connected that we cannot identify ...

The MAC address starts 46: I have checked various web sites to get and find the device, but nothing. Is there a full database that holds all MAC allocations.
I really need to find the device. ... Just have an uneasy feeling about it.

My PC, wife's PC, my phone, her phone, Apple Mac, alarm, wireless extender, Apple TV, are all accounted for.

Tried to ping it at xxx.xx.x.133 and the responses were: No response from xxx.xx.x.134 or 84 which was a bit odd.

The IEEE registration authority is where the MAC addresses are aligned to companies, their lookup system is heavily restricted. You're after an OUI lookup and Wireshark is a place to start:
https://www.wireshark.org/tools/oui-lookup

You will need the whole MAC to do a lookup, often the first 4 or 5 sections are the company, and can be either the hardware maker or the assember. e.g. Apple uses broadcom for WiFi and Ethernet chips but has their own MAC allocation, other vendors using Broadcom Ethernet cards might show Broadcom as the vendor.

Thanks ... the full MAC is 42:9a:34:d2:80:58 and nothing appears anywhere and I've tried the various formats.

You could try running Nmap (the Zenmap GUI) against the IP to see what that reveals.

If the locally-administered address (LAA) bit is set (i.e. the first octet is x2, x6, xA or xE) the address is made up so won't appear in any registration databases, see https://en.wikipedia.org/wiki/MAC_address#Universal_...

Most commonly generated by network privacy functions in newer mobile device OS.

In reply to a post by tdw42:

Most commonly generated by network privacy functions in newer mobile device OS.

Also available in macOS and Windows11 (may even be in Win10). Defaults to on with iOS/iPadOS and shows "privacy alert" when disabled, even when you want to statically assign IP to MAC...

The worry is that someone has secreted a device in the house - possibly using the WPS set up on the router/WAP. And I want ot find out exactly what it is.

A possible ……

Apple devices may have private wifi enabled

https://support.apple.com/en-gb/HT211227#:~:text=Abo...

Thanks, tried that ...

The IP brings back the same MAC and reports no OS match for host ... nothing in te data returned points to a known device.

In reply to a post by MHC:

The worry is that someone has secreted a device in the house - possibly using the WPS set up on the router/WAP. And I want ot find out exactly what it is.

Change the WiFi key on the main router, set up a second router with the old SSID and WiFi key and see if anything connects.

Win11:
https://support.microsoft.com/en-us/windows/how-to-u...

That may have cracked it ...

Had checked the MAC for an iPad earlier - nothing like it. But yes, they use "private MAC addresses" and don't identify the device type to te network either. The Router can tell me what brand of phone, laptop, alram system &c, but this one "nothing"

Now turned OFF

My SH2 device screen is littered with unknown_macaddress entries.

I came across this when assigning a meaningful name to each device. After a few days, I saw unknown and then traced it to the 5 Apple devices

Glad to have helped instead of asking for help

In reply to a post by MHC:

Had checked the MAC for an iPad earlier - nothing like it. But yes, they use "private MAC addresses" and don't identify the device type to te network either. The Router can tell me what brand of phone, laptop, alram system &c, but this one "nothing"

Exactly, I have various DHCP servers here, and when "private" mode is on, you can't tell which Apple device it is. Fing box and even general linux dhcpd doesn't even get sent the device name. Great for using public WiFi hotspots, but irritating at home.

It makes this sort of tool, or equivalent parental controls, almost painfully useless:
https://www.fing.com/products/fingbox

Thanks,

That was next on my list to try, I had found an old WAP to use. But as you have seen above, finally solved as an errant iPad !

Yep, thanks.

As I mentioned, it is in the home of an elderly man, who is 95 and very frail.

I had a "random" connection which turned out to be a smart meter. No idea if that may be what you are looking for,

In reply to a post by Rhynchelma:

I had a "random" connection which turned out to be a smart meter. No idea if that may be what you are looking for,

I thought they worked on a different system and could not be picked up by normal Wi-Fi.

In reply to a post by zyborg47:

I thought they worked on a different system and could not be picked up by normal Wi-Fi.

In Scotland the smart meter to engergy company uses a low freq network built specially. In england the smart meter to energy company is over mobile data (3G or 4G). The link from the meter to the "in home display" could be a WiFi connection but is unlikely to be given interference.

If smart meters connected to our internet WiFi routers there would be problem every time people swapped ISP and had a new router. The call centres would be overloaded. This is why they don't use your home WiFi.

In reply to a post by jchamier:

In Scotland the smart meter to engergy company uses a low freq network built specially. In england the smart meter to energy company is over mobile data (3G or 4G).

Only in the Southern England, I believe. In NE England, at least, they use Arqiva's purpose built Long Range RF network

The link from the meter to the "in home display" could be a WiFi connection but is unlikely to be given interference.

They use ZigBee for the HAN.

Edited by Davey_H (Sun 02-Jul-23 11:31:26)

In reply to a post by Davey_H:

Only in the Southern England, I believe. In NE England, at least, they use Arqiva's purpose built Long Range RF network.

I thought the boundary was very north, ie Newcastle just gets the dedicated network, and everything south is cellular ?

They use ZigBee for the HAN.

Thanks, that makes sense. Searching the DCC website shows they're using 2.4 GHz just like Philips Hue light bulbs or Hive thermostat. There is also a new 868 MHz low band for problematic areas.

Absolutely no way a Smart Meter item should show on a home router!

This very old page says Telefonica in the south, and Arqiva in the north but doesn't show the line...
https://www.gov.uk/government/news/award-of-smart-me...

I guess the Govt at the time realised cellular wouldn't work in the north with so many holes in coverage.

Edited by jchamier (Sun 02-Jul-23 11:41:35)

This web page would indicste that there can be a WiFi = smart meter link. I would guess that the installers activated it. Can't remember myself. May have been another family member who provided the password.

In reply to a post by Rhynchelma:

This web page would indicste that there can be a WiFi = smart meter link. I would guess that the installers activated it. Can't remember myself. May have been another family member who provided the password.

That would make sense for the In Home Display - not necessarily the smart meter per se. Th Smart Meter to IHD link is fairly tightly locked down via ZigBee.

In reply to a post by Rhynchelma:

This web page would indicste that there can be a WiFi = smart meter link. I would guess that the installers activated it. Can't remember myself. May have been another family member who provided the password.

That looks a fairly impressive IHD, the ones I've seen have been a lot less featured. Also bulb is now nomore, so who knows....

In reply to a post by Pheasant:

That would make sense for the In Home Display - not necessarily the smart meter per se. Th Smart Meter to IHD link is fairly tightly locked down via ZigBee.

I've met a lot of people whom think the display is part of the meter, not aware it can be unplugged and put in a drawer and not affect the metering at all.

We had a early gen SMETS1 meters courtesy of British Gas back in the day (August 2017) then we changed supplier and the smart meters became dumb....

Now after a lot of water under the bridge and a 3-phase upgrade in this house, I'm waiting on a new SMETS2 smart meter to be installed. They've already missed one appointment and I have a follow up scheduled for next Friday.

I'm not hopeful.

In reply to a post by Pheasant:

I'm not hopeful.

I've been watching this chaos and so far haven't ventured into the smart meter game, although most of my friends have by now, some due to needing offpeak pricing for EV cars.

In reply to a post by jchamier:

In reply to a post by Pheasant:

I'm not hopeful.

I've been watching this chaos and so far haven't ventured into the smart meter game, although most of my friends have by now, some due to needing offpeak pricing for EV cars.

That's pretty much the only reason I'm persisting this time around.

Not wishing to be contentious and speaking from ignorance, if the display has WiFi, surely the meter is sending it the data the same way. Or am I missing something?

In reply to a post by Rhynchelma:

Not wishing to be contentious and speaking from ignorance, if the display has WiFi, surely the meter is sending it the data the same way. Or am I missing something?

(Don't worry not contentious - fair question)

No the actual meter (installed at the supply cutout) communicates with the display (so called IHD or In Home Display) using the ZigBee protocol. This is known as the HAN - Home Area Network - but it is not an open network. It is deliberately closed.

Although the meter has an LCD display, so that you can read it - this is a different "display" to the IHD - which happens to be entirely optional, and as noted above, could well be shoved in the drawer as it doesn't affect the operation or metering ability of the meter itself. Its just extra stuff they give to customers so they can see what is happening without having to necessarily look in the meter cupboard / and/or get some extra stats and infor.

Any other subsequent connections to the IHD for apps, browser etc could well be using WiFi but they definitely wont be using ZigBee on the HAN.

Edited by Pheasant (Sun 02-Jul-23 19:20:07)

M-in-law had SMETS2 gas and electric installed in Aug 2021 - a condition of the energy tariff. Worked fine until Nov 21 when no readings sent via Comms hub. No light on Comms hub suggested it was dead.

6 months later after escalation to supplier CEO and tweets, the meters were swapped. Gas and electric sent readings and then gas stopped. Gas and electric meters are 30 cm apart. Supplier says industry wide issue that they cannot fix - they don’t make the meters. Engineer said it has been known for updates to cause issues

SMARTDCC doesn’t want to know.

No one is bothered about the issue

Sadly about what I've come to expect from most governmental IT projects.

Thanks for that. We live and learn.