Very strange problem---- phantom network devices.

[JohnEJohn]

Ok this is quite bizarre, yesterday I noticed that an unknown device had appeared in windows explorer on my local network which no one in the house owns, a Huddle (Cheap tablet). Looking at the properties a mac address is present but no ip address.

Now the strange part is, checking the router there are no devices connected or have there ever been other than the ones we own. The devices have no ip address assigned and are inaccessible, they cannot be pinged etc (no ip).

I was going to just enable mac filtering just in case but why the hell has the router not connected to anything at any point other than our equipment.

I have just had another look now and a nexus 7 is now apparently on the network with a different MAC address and no ip address, really scratching my head here as we don't own one of those either.

The network is wpa2 and has a strong key, the routers login is not the default and I'm using windows 8.1 with a wireless dongle.

The only thing that I can think of is that a close neighbours device is looking for a wireless network and my network is picking up but not assigning an ip address as it's not authenticating the device. I also say this as when I refresh the device is usually gone again.

I changed the wireless key just to see what would happen but the odd behaviour persists.

Anyone ever experience something as strange as this?

[Sazar]

NSA?

[JohnEJohn]

NSA?

Hopefully not

I must admit, when I first saw this at 3am this morning I disconnected my work drive just in case.

[Munkus]

When I open my router's config page I often see a few devices on my wifi network that aren't mine. Which is weird, considering that I have MAC address white-listing turned on. When I click the Refresh button the devices go away. I think Obama is stalking me.

[JohnEJohn]

Now there's an HTC one with unique mac address... something really freaking strange is going on here.

There is only ever one of these devices visible at any given time.

[Munkus]

Now there's an HTC one with unique mac address... something really freaking strange is going on here.

There is only ever one of these devices visible at any given time.

You have your wifi router white-list enabled on both bands (2.4Ghz and 5Ghz)?

[JohnEJohn]

The thing is, the devices are not connecting to my router, that is the confusing part.

They are showing up in internet explorer under network devices with no ip address but have never even attempted to connect to the router according to the logs.

I even disabled bluetooth radio, even though it was not discoverable just in case.

It's really odd, I have been a techie for years and I have never come across this one, really strange.

[JohnEJohn]

Disabling the service, windows connect now (wps) seems to have done the trick.

Must be the next door neighbours.

[JohnEJohn]

If anyone's interested why this occurs, in windows 8+ (possibly can occur in win 7), the topography of the network map includes devices which are not only connected to your network but are also seeking for a connection.

It seems as though most routers do not log the login attempt as it is not authenticated but windows 8+ will show devices which have attempted to connect to the network regardless and can seem to be 'ghost devices' which are on your local network, hence the reporting of only the mac and no assigned ip address etc.

There is nothing to worry about, your network devices cannot be accessed.

Whitelisting devices does not seem to alleviate the symptom, as long as a device can see the routers ssid it will try to connect to it regardless so the only way is to disable broadcasting.

Disabling the effected windows machines homegroup or windows connect now (wps) service works, I believe that this works as the erroneous connection attempts are just no longer reported, nothing more, nothing less.

Lastly some devices may look as though they are an unknown make or model, one of which you do not own but may actually be a device that you do own but is being reported incorrectly due to invalid authentication processes, just check the macs.

Tldr: Nothing to see here folks, move along.