A program "Who is on my wifi" indicates a device with a mac address of 00:05:04:03:02:01. Does anyone know what it is? I have Cisco router from the local ISP.
34 Answers
You can plug that into one of the OUI lookup sites on the Internet to discover the company which owns the OUI.
More than likely, with a pattern like 54321, it is someone who is using a made-up MAC address. It is relatively easy to spoof a MAC address.
The Wireshark OUI lookup tool () shows that the prefix 00:05:04 is registered to a "Naray Information & Communication Enterprise". That appears to be a component manufacturer / OEM, so no help there.
If your ISP gave you the login to your router, you could look to see what IP address and/or device has that MAC address--or even better, it might be printed on your equipment somewhere.
You could also use Google to learn how to use ARP (either by itself or with the arping command) to learn the IP address using that MAC. Perhaps the IP matches that of your router (the "default gateway" configured on your computer).
The preceding is good to learn, but @RonMaupin is probably right about it being spoofed.
4I found a similar mystery host on my network, and ended up here looking for an answer, 2+ years since the last update :). But since this page has 5K views, I thought others might still be interested in my answer.
An nMap scan of my network showed a TCP listener on 10.0.0.254:49152 (mac 00:05:04:03:02:01). (By the way, 49152 is C0:00 in hex)
In my case the culprit was my Xfinity Wireless Gateway (a Cisco model), which is set up to work at 10.0.0.1. But on the 10.0.0.254 address it seems to be hosting a server that supports the gateway's Wireless Protected Setup (WPS) feature.
I discovered that info by firing up Wireshark and watching for traffic to/from the 10.0.0.254 address. What I saw were some SSDP notification messages. These included the URL http:// 10.0.0.254:49152/wps_device.xml. Browsing that url provided model information identifying my XFinity/Cicso Gateway.
If you've got a Cisco Router/Gateway, perhaps you can skip the Wireshark step, and just try that URL on the IP your mystery host shows up at.
I haven't tried it myself yet, but I'd imagine that disabling WPS and/or UPnP (which WPS often makes use of) on the gateway might make the 254 host disappear.
It is an ASA Cisco firewall. You'll notice the only port open is 49152 as well. I am a Cybersecurity & Forensics student. Firewalls use the 54321 MAC address a lot to make it easy to identify.
2
