This topic

Random Mac addresses on wifi, am I being hacked?

PM3 — Mon, 10 May 2021 12:16:51 GMT

Hi, I've been looking at my event log and have found random MAC addresses on there. It was saying 2.4g MAC address deauthentications reasons disassociated due to inactivity. It was about 6 of them with different MAC address and none of them mine. Well I have never seen them before. There is nowhere saying that they connected it only comes up with dissociation. Does the 2.4g MAC address deauthentications mean that a device has been disconnected from the wifi?

I did a factory reset on Friday and changed my password and then in the early hours on the event log there was another 2.4g MAC address deauthentication reasons disaccociated due to inactivity on there. Even after resetting and none of my devices being connected

I went today on my event log to copy and paste into this forum to show you guys and I can't find any of this on there anymore.

Re: Random Mac addresses on wifi, am I being hacked?

stevebrass — Mon, 10 May 2021 12:21:09 GMT

Do you have any Apple devices?

Re: Random Mac addresses on wifi, am I being hacked?

Les-Gibson — Mon, 10 May 2021 12:39:34 GMT

@stevebrasswrote:
Do you have any Apple devices?

In particular, those running iOS14.

see https://support.apple.com/en-gb/guide/security/secb9cb3140c/web

and https://community.bt.com/t5/BT-Devices/Private-Address-MAC-Randomisation-iOS14-Apple-devices/m-p/2111145#M18488

Re: Random Mac addresses on wifi, am I being hacked?

PM3 — Mon, 10 May 2021 12:41:40 GMT

Hi guys,

I do have apple devices.

Re: Random Mac addresses on wifi, am I being hacked?

Les-Gibson — Mon, 10 May 2021 12:46:29 GMT

@PM3wrote:
Hi guys,
I do have apple devices.

One of them will most likely be responsible

Re: Random Mac addresses on wifi, am I being hacked?

PM3 — Mon, 10 May 2021 12:46:34 GMT

What does this mean?

WHW INFO A station (SmartHub2)IF[5G](E4:75:DC:83:AD:39):STA(5C:BA:EF:96:3C:21)(Legacy Device) join WHW infrastructure

I looked up the mac address and it arcaydian corporation.

Re: Random Mac addresses on wifi, am I being hacked?

Les-Gibson — Mon, 10 May 2021 12:51:10 GMT

Do you have an LG TV?

https://www.reddit.com/r/eero/comments/jj1xng/arcadyanon_my_network/

Re: Random Mac addresses on wifi, am I being hacked?

PM3 — Mon, 10 May 2021 13:11:10 GMT

Hi,

No Hitachi and its not connected to the internet. I haven't connected since doing a factory reset.

The only things I have had connected are 2 laptops and an Ipad.

Thanks guys for helping. I've been so worried that someone has been trying to hack into my wifi.

Re: Random Mac addresses on wifi, am I being hacked?

TimCurtis — Mon, 10 May 2021 14:13:48 GMT

@PM3

With iOS 14 Apple introduced Private Addresses meaning that whenever your device connects to wifi it generates a random MAC address. This function was set as ON by default (wrong) and for wifis that you connect to regularly like home or parents etc you should switch off this function. Go into settings & Wifi and tap the "i" icon to the right of the Wifi name & then turn off private addresses. It's switchable by individual SSIDs.

Re: Random Mac addresses on wifi, am I being hacked?

PM3 — Mon, 10 May 2021 16:39:45 GMT

Thanks, I am going to turn it off and see what happens. I will monitor it over the week. I want to keep this discussion open and then get back to you about what happens. Thanks guys

Re: Random Mac addresses on wifi, am I being hacked?

PM3 — Tue, 18 May 2021 11:49:31 GMT

Good morning guys,

Is this an attack. The first part was at 9am this morning and second part was at 7am this morning.

9:00:002 DoS(UDP Loopback): IN=ppp1 OUT= MAC= src=184.105.139.113 DST=86.172.255.252 LEN=29 TOS=0x00 PREC=0x00 TTL=52 ID=13870 DF PROTO=UDP SPT=35571 DPT=19 LEN=9 MARK=0x8000000

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=17658 PROTO=TCP SPT=54679 DPT=2714 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=55354 PROTO=TCP SPT=54679 DPT=2796 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=41341 PROTO=TCP SPT=54679 DPT=2503 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=46140 PROTO=TCP SPT=54679 DPT=2794 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=64292 PROTO=TCP SPT=54679 DPT=2933 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54061 PROTO=TCP SPT=54679 DPT=2850 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=38464 PROTO=TCP SPT=54679 DPT=2983 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=61433 PROTO=TCP SPT=54679 DPT=2811 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

Is this anything to worry about?

PM3 — Tue, 18 May 2021 13:20:23 GMT

Good afternoon guys,

Is this an attack. The first part was at 9am this morning and second part was at 7am this morning.

9:00:002 DoS(UDP Loopback): IN=ppp1 OUT= MAC= src=184.105.139.113 DST=86.172.255.252 LEN=29 TOS=0x00 PREC=0x00 TTL=52 ID=13870 DF PROTO=UDP SPT=35571 DPT=19 LEN=9 MARK=0x8000000

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=17658 PROTO=TCP SPT=54679 DPT=2714 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=55354 PROTO=TCP SPT=54679 DPT=2796 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=41341 PROTO=TCP SPT=54679 DPT=2503 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=46140 PROTO=TCP SPT=54679 DPT=2794 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=64292 PROTO=TCP SPT=54679 DPT=2933 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54061 PROTO=TCP SPT=54679 DPT=2850 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=38464 PROTO=TCP SPT=54679 DPT=2983 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

07:00:02, 18 May.

DoS(Port Scanning): IN=ppp1 OUT= MAC= src=89.248.165.97 DST=86.172.255.252 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=61433 PROTO=TCP SPT=54679 DPT=2811 WINDOW=1024 RES=0x00 SYN URGP=0 MARK=0x8000000

Re: Random Mac addresses on wifi, am I being hacked?

licquorice — Tue, 18 May 2021 15:08:11 GMT

Just your firewall doing its job.

Please don't post the same question in more than one place, it just causes total confusion for replies. I have merged your posts.

Re: Random Mac addresses on wifi, am I being hacked?

PM3 — Tue, 18 May 2021 17:13:02 GMT

Thank you for your reply. I did another post as I didn't think no one would read the old thread.

Re: Is this anything to worry about?

PARKERTEK — Thu, 20 May 2021 09:58:23 GMT

Yes this is definitely just your firewall doing it’s bit.
I’d try not to post your public IP address online though, that MIGHT lead to someone attempting hack, just a tip 😁

Re: Is this anything to worry about?

Les-Gibson — Thu, 20 May 2021 10:55:22 GMT

The IP address ending 252 is yours, the others both lead to sites which claim to be legitimate sites for gathering information on the internet.

One claims to be working with law enforcement agencies for improving security on the internet, the other just states that it gathers information such as open ports but doesn't say why

Re: Is this anything to worry about?

PM3 — Thu, 20 May 2021 15:11:24 GMT

Thanks guys. This has just happened again and theres like two pages of it in my log plus this -

2.4G client Mac: Deauthentications (Reason:Deauthenticated because sending station is leaving (or has left) IBSS or ESS)

Which is my roku box and there's also 2 pages of this.

Re: Is this anything to worry about?

licquorice — Thu, 20 May 2021 15:21:05 GMT

Virtually every broadband user will have the same thing in their logs, it is a fact of life when connected to the internet, That is why you have a firewall.

The other, is just mobile device disconnecting.

Re: Is this anything to worry about?

PM3 — Thu, 20 May 2021 18:20:49 GMT

Thank you. So I guess there is nothing to worry about.

What things would you look for if there was a hack?

The whole police improving security thing sounded a little strange.

Re: Is this anything to worry about?

licquorice — Thu, 20 May 2021 20:03:35 GMT

Its extremely unlikely that you will be 'hacked' by a brute force attack on your home router. Any sort of hacking problems you encounter will either be due to a hack of a commercial site exposing your details or by clicking on dodgy links in phishing emails.