What’s this device on my network?

What’s this device on my network?

Q Periodically, I check if anyone is on my network apart from my own devices, using a program from NirSoft. Recently, I came across a device with the IP address 192.168.1.214. I recognise the first three parts of this, but I cannot find any device with 214. It apparently also has the code CA-5F-AD-85-FC-D9. This looks like a software serial number but on a search all I get is it might be a security certificate. Any ideas?

Martin Fletcher

A You didn’t tell us which NirSoft program you used, but we think it’s Wireless Network Watcher , as this shows all sorts of information about devices connected to your router – including both IP and MAC addresses.

IP addresses are those that begin with 192.168.1, and which you recognise. MAC is short for ‘media access control’, which describes a unique string of hexadecimal numbers assigned by manufacturers of networking devices. We mention this because the code you cite (CA-5F-AD-85-FC-D9) is a valid MAC address. You can look these up online, using a tool like macaddress.io https://macaddress.io/, see screenshot 1) to find out who manufactured it. However, this one turns up a blank.

That’s not necessarily suspicious, as some products can be manufactured on a ‘white label’ basis, where the original maker sells on the product to a third-party vendor. But this fact doesn’t help us – or you – identify the mystery device.

Now, we should offer some reassurance by saying that this is most likely some gadget that’s easy to overlook or forget, like an old smart TV or digital photo frame, say. That might be enough to trigger a memory that helps you finger this interloper. But, if not, to be on the safe side we’d suggest denying the device network access. Then, if something in your home stops working, the mystery device will be identified.

You can do this via your router’s web interface, using a feature known as MAC filtering. We don’t know your router make or model, but most have a tool along these lines and they’re generally pretty simple to configure – it’s really nothing more than an electronic blacklist.

So, first log in to your router’s administration page. You can do this via your web browser, typically by typing 192.168.0.1 (or similar) into the address bar. Now look for an option labelled ‘MAC Filtering’ (or similar), perhaps in a section like Wi-Fi or WAN.

How to proceed next depends very much on the particular router and its software. However, the fundamental idea is to tell the router to block access to the device with the offending MAC address. So, first look for a switch or option to enable MAC filtering, and then add the CA-5F-AD-85-FC-D9 code to the filter (or ‘block’ or ‘deny’) list 2. Individual filters might be described as ‘rules’, incidentally.

Once you click the Save or Apply (or similar) button, the device with that MAC code will have its internet connection cut. If you then figure out which device it is, it’s easy enough to restore its line to the outside world by returning to the router admin page to delete the MAC filter just created.