Mac address spoofer?

I have a spreadsheet that contains the Mac addresses of all my network devices (OK, so I have OCD) and I regularly check this against my router clients table to ensure that every device on my network is mine.

But recently -- I have found an Unknown Device on my network (all mine have names I have assigned) with a Mac address of 1A6:C7:4F:4F:80. So. I used a web address for a Mac address checker, entered that address, and it said Manufacturer Not Found. So, this basically an unassigned Mac address.

I have gone into my Router security section and DENIED this address.

I'm now waiting for something we own to stop accessing the Internet and start complaining about it -- but I suspect this this is a Spoofer.

It doesn't have to be a malicious spoofer. Windows can randomize MAC address for privacy reasons.
But I understand your concern.

garlin said:

It doesn't have to be a malicious spoofer. Windows can randomize MAC address for privacy reasons.
But I understand your concern.

How to use random hardware addresses in Windows - Microsoft Support

Find out how to use random hardware addresses in Windows.

support.microsoft.com

Click to expand...

I didn't know that Windows did that; I only knew that Android did that.

But my desktop, where this is happening, does not have WiFi -- so there is no random setting to change.

I checked my Win11 laptop, which does have Wifi (it is the only Windows device I have with WiFi) and Random Settings is turned OFF.

I guess one of the Android devices could be doing this, and not a Windows device? If so, I will have to check them all.

You can temporarily hide your SSID, and see if the unknown device returns. Your router might be picking up your neighbors' devices.

garlin said:

You can temporarily hide your SSID, and see if the unknown device returns. Your router might be picking up your neighbors' devices.

Click to expand...

Yeah, that's an option.

I checked the Android devices that are new enough to allow random Mac and some of them were sent to random, so I set them all to manual -- but the device was still there.

But this morning, the device is gone.

If it returns, I will use the Router Security function to DENY the device.

Thanks for your help in this.

Mark Phelps said:

I have found an Unknown Device on my network

Click to expand...

What was it that told you that that device was connected to your network? Your router 'client table'?
Did the command
ARP -a
confirm the existence of that device?


Denis