# mystery device on my home network **URL:** \ **Category:** Factual Questions\ **Created:** [July 28, 2019, 1:14am UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736 "2019-07-28T01:14:45Z")\ **Posts on this page:** 13\ **Page:** 2
**Author:** ![rbroome](https://avatars.discourse-cdn.com/v4/letter/r/838e76/32.png) [@rbroome](https://boards.straightdope.com/u/rbroome)\ **Post date:** [July 29, 2019, 12:29am UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/21 "2019-07-29T00:29:02Z")
> [@Joey\_P](#): > > Some devices (well, Tivos) grab two IP addresses. I don’t know why, but it took me a long time to figure out what was going on there. > > Something you could do is block the MAC address and see what stops working. Just remember the next time something (network connected) in your house stops working, you unblock that MAC address before you spend too long troubleshooting. > > Also, depending on your router, you may have the ability to block ALL new connections until you log in and OK them. That’s how I have mine set up. Although I tend to forget about that setting until I’ve spent 20 minutes trying to get a new device online. I did that. Nothing stopped working including a ping response from the mystery service. As far as I can tell, blocking the MAC address had no effect. ---
**Author:** ![Melbourne](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Melbourne](https://boards.straightdope.com/u/Melbourne)\ **Post date:** [July 29, 2019, 12:30am UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/22 "2019-07-29T00:30:01Z")
I’m not familiar with the router. It may be the IP assigned to the VOIP device. Do you have a phone plugged into it? ---
**Author:** ![rbroome](https://avatars.discourse-cdn.com/v4/letter/r/838e76/32.png) [@rbroome](https://boards.straightdope.com/u/rbroome)\ **Post date:** [July 29, 2019, 4:39pm UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/23 "2019-07-29T16:39:05Z")
> [@Melbourne](#): > > I’m not familiar with the router. > > It may be the IP assigned to the VOIP device. Do you have a phone plugged into it? Now that is an excellent suggestion. Yes, there is a VOIP phone plugged into the router. I haven’t noticed a specific local IP address assigned to phones in the past, but I wasn’t looking for it. Thanks ---
**Author:** ![Joey\_P](https://avatars.discourse-cdn.com/v4/letter/j/919ad9/32.png) [@Joey\_P](https://boards.straightdope.com/u/Joey_P)\ **Post date:** [July 29, 2019, 5:16pm UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/24 "2019-07-29T17:16:57Z")
> [@rbroome](#): > > I did that. Nothing stopped working including a ping response from the mystery service. As far as I can tell, blocking the MAC address had no effect. If you can ping it, it’s still connected, yes. I don’t know the ins and outs of your router, but it’s possible that after blocking the device, you may have to reboot the router. IOW, blocking a device might just prevent it connecting but not actively kick it off the network. ---
**Author:** ![BlankSlate](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/blankslate/32/80_2.png) [@BlankSlate](https://boards.straightdope.com/u/BlankSlate)\ **Post date:** [July 29, 2019, 5:34pm UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/25 "2019-07-29T17:34:28Z")
I seem to recall that a past router I had maintained different MAC addresses for ethernet and wifi. Am I mis-remembering or is that a possibility? ---
**Author:** ![Shoeless](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/shoeless/32/7099_2.png) [@Shoeless](https://boards.straightdope.com/u/Shoeless)\ **Post date:** [July 29, 2019, 5:50pm UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/26 "2019-07-29T17:50:00Z")
Do you have wireless cable boxes? Is it possibly the device that broadcasts the signal to the wireless boxes? ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [July 29, 2019, 5:58pm UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/27 "2019-07-29T17:58:32Z")
Try running nmap on it with a couple of options like “-sS -A -T4”. That should produce enough information to narrow down which device it is. ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [July 29, 2019, 7:32pm UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/28 "2019-07-29T19:32:19Z")
> [@Alley\_Dweller](#): > > AT&T Internet (formerly known as AT&T U-verse) does not allow customers to supply their own modems. You have to use the AT&T-supplied modem. They do not charge a separate rental fee for the modem. You are free to attach your own router/wifi access point to their modem. > > The legacy DSL service did allow you to purchase your modem. Even if you have to chain another router after the AT&T one, it still provides another layer of security. A router’s main security function is just to discard wayward botnet traffic anyway, so even if your AT&T is so horribly compromised that it lets random stuff into your LAN, your second router should just discard it since there’s not a port mapping for it to go to. From what I remember of my shitty Uverse router, it didn’t let me adopt an actual bridge mode, but you can turn off some of the features and just pass most traffic through to a secondary router and let that do all the work. If you connect all your devices to the second router instead of the AT&T one, it doesn’t really matter what the other unidentified IP is. To your second router, it just looks like any other traffic outside your LAN, meaning it’ll be ignored unless there’s an active request from within your network to it, or a port forward that you manually set up. Keep your VOIP connected directly to the first router and it should still continue to work, while your other devices are shielded by the second router that you 100% control. You probably shouldn’t trust ISP-issued routers anyway. They’re rarely updated and often deliberately backdoored, on top of frequent wifi and performance issues. ---
**Author:** ![rbroome](https://avatars.discourse-cdn.com/v4/letter/r/838e76/32.png) [@rbroome](https://boards.straightdope.com/u/rbroome)\ **Post date:** [July 30, 2019, 11:04am UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/29 "2019-07-30T11:04:42Z")
> [@Reply](#): > > Even if you have to chain another router after the AT&T one, it still provides another layer of security. > > A router’s main security function is just to discard wayward botnet traffic anyway, so even if your AT&T is so horribly compromised that it lets random stuff into your LAN, your second router should just discard it since there’s not a port mapping for it to go to. > > From what I remember of my shitty Uverse router, it didn’t let me adopt an actual bridge mode, but you can turn off some of the features and just pass most traffic through to a secondary router and let that do all the work. > > If you connect all your devices to the second router instead of the AT&T one, it doesn’t really matter what the other unidentified IP is. To your second router, it just looks like any other traffic outside your LAN, meaning it’ll be ignored unless there’s an active request from within your network to it, or a port forward that you manually set up. > > Keep your VOIP connected directly to the first router and it should still continue to work, while your other devices are shielded by the second router that you 100% control. > > You probably shouldn’t trust ISP-issued routers anyway. They’re rarely updated and often deliberately backdoored, on top of frequent wifi and performance issues. Thanks. there are certainly backdoors in the UVerse routers (see my earlier post). Updates however aren’t a problem any more. The router updates itself whenever it wants to-which apparently is quite frequently. What changes are made are of course completely obscure. ---
**Author:** ![DPRK](https://avatars.discourse-cdn.com/v4/letter/d/4491bb/32.png) [@DPRK](https://boards.straightdope.com/u/DPRK)\ **Post date:** [July 30, 2019, 7:25pm UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/30 "2019-07-30T19:25:11Z")
Are the AT&T modem and router two separate units or one? Is there really no way to replace one or both with a decent-brand, non-shitty router? Did the mystery device turn out to be just a VOIP phone, or something more nefarious? ---
**Author:** ![Alley\_Dweller](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/alley_dweller/32/430_2.png) [@Alley\_Dweller](https://boards.straightdope.com/u/Alley_Dweller)\ **Post date:** [July 30, 2019, 10:32pm UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/31 "2019-07-30T22:32:19Z")
> [@DPRK](#): > > Are the AT&T modem and router two separate units or one? Is there really no way to replace one or both with a decent-brand, non-shitty router? > > Did the mystery device turn out to be just a VOIP phone, or something more nefarious? AT&T gives you a combination modem, router, and wifi access point. You are free to plug your own router or wifi/router into your AT&T modem. However, if you have TV service or VoIP phone, those must be plugged directly into the modem. Their security checks won’t let you use their internet unless you are going through the modem they supplied you. ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [July 31, 2019, 4:10am UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/32 "2019-07-31T04:10:10Z")
> [@BlankSlate](#): > > I seem to recall that a past router I had maintained different MAC addresses for ethernet and wifi. Am I mis-remembering or is that a possibility? > [@DPRK](#): > > Try running nmap on it with a couple of options like “-sS -A -T4”. That should produce enough information to narrow down which device it is. Try running ping then arp-a from both wired and wifi to get the associated mac of your router. IPCONFIG /ALL will tell you the gateway IP address - maybe different for wifi? treaceroute 8.8.8.8 will show you the hops (sifi vs. wired) to get to the internet. Does it go via the 1.68 address? ---
**Author:** ![rbroome](https://avatars.discourse-cdn.com/v4/letter/r/838e76/32.png) [@rbroome](https://boards.straightdope.com/u/rbroome)\ **Post date:** [August 1, 2019, 9:46pm UTC](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736/33 "2019-08-01T21:46:24Z")
> [@md2000](#): > > Try running ping then arp-a from both wired and wifi to get the associated mac of your router. > IPCONFIG /ALL will tell you the gateway IP address - maybe different for wifi? > treaceroute 8.8.8.8 will show you the hops (sifi vs. wired) to get to the internet. Does it go via the 1.68 address? Thanks. I will try that. I still don’t know whether the mystery local IP is for the VOIP or not. As stated by others, the modem and router are the same physical box. I have not put my own router in yet. But I am considering it. Thank you again for all the input. [Previous page](https://boards.straightdope.com/t/mystery-device-on-my-home-network/837736.md?page=1)