Intrusion?! Unknown Device/Repeater shown in Windows 10 Network from IPFire

Hey Guys,

i have 3 IPFire running and i´m a experienced user but theres one thing that i dont understand.

As i worked on Network i saw suddenly a TP-Link Repeater Device (unfortunately i didnt have one) with a Mac Adress but no IP. Also see it from my other Win PC…
When i Angry IP Scan, the device is not visible there.
I tried everything, restarted PC´s, disabled WLAN, then disconnected step by step everything from my Ipfire and got to the point where i was only connected straight to the port of IPFire with my PC.
The Device stays in Windows Explorer most of the time, sometimes it disappears for 1 minute but then its back again.
So i checked my IPFire for software in Pakfire, deinstalled all (had no dlna service running or so only samba), same behaviour.
First thougt was my wifi pw got hacked, but as i disconnected all, there must be some strange thing going on with my IPFire?

Anyone here who can explain this behaviour?

The Mac Adress of my Network Cards inside IPFire dont match that Device

Attached are Screenshots,
thx in advance

Simon

Hi @simonides

first of all, welcome to the IPFire community !

I’m sure that several experts will intervene here to help you but your symptoms remind me of a problem that I myself have seen recently…

Do you have a pair of Power-Line-Carrier (CPL) in your network?

Some brands are massively paired by default and all communicate with each other (eg with one of my clients, there were 23 extra devices in his network)

Otherwise :

What is the distance with your neighbors (house, apartment, residence, compagny) ?

In which network did your unknown device appear (red, green, orange, blue) ? Is IPFire a DHCP server ?

Edit : Without specific settings, I prefer Advanced IP Scanner which detects better than Angry IP

Hey Steph,

thanks for your answer,

I have only RED and GREEN Interface on this location, no Powerline adapters, no other things going on.
On my way to troubleshoot where or what this device should be I closed all VPN connections, unplugged all Lan Cables/Devices that goes to Green Interface and connected in last instance only my Thinkpad directly to GREEN Network Card and got the same result.

At the last try i uninstalled all software in pakfire but no success.

Unfortunately i dont know what simulates this devices or if there is real problems going on in my network.

But hey, things going more crazy, i looked again and boom, there is a Samsung-TV now also…Screenshot attached
I have no Samsung TV, i have a Philips PUS75 which also shows up.
And so fast it was there, so fast it is gone now.

Weird weird weird…

Okay, the Samsung TV now give me the answer straight out of google.

There seems to be a very bad bug either on Netgears or Microsoft´s side about seeing devices that are only present in their cloudy brains of zeroes and ones…

Disabling the Service wcncsvc solve that issue. Its for WPS connections.

Thanks anyway and hope this can help someone settle down before plugging all power chords in thougts of gettin hacked :wink:

2 Likes