0

I am asking a follow-up question to "Private" MAC Address.

Today I found a wireless device with the following MAC address on my home network: 28:EF:01:A9:F1:0A.

Looking that up at http://aruljohn.com/mac/28EF01A9F10A says it's Private. The MAC address does not follow the second-least significant bit of the most significant byte set rule mentioned in the referred post.

On my network is an iPhone 5, a Samsung notebook running Windows and a Raspberry Pi. The Raspberry Pi is connected by wired LAN and is showing up correctly with its own MAC address.

What is the most likely explanation for this "private" device? It disappeared after about 10 minutes.

  • Have you determined if its being connect by WAN or LAN? The simple solution is enable MAC Address whitelisting, and don't whitelist this MAC Address, its literally could be any device since masking a MAC Address is trivial. – Ramhound Apr 6 '16 at 14:56
  • Possible duplicate of "Private" MAC Address – DavidPostill Apr 6 '16 at 14:58
  • @Ramhound I am afraid that if the MAC is harmless and required, blocking it might break something. What do you mean by connected by WAN or LAN? It has a LAN IP if that is useful information. – Old Geezer Apr 6 '16 at 15:02
  • If its blocked you then determine what the device is, because what you broke, quickly becomes evident. if you can't even identify if its connect by WAN or LAN, how can we help you, identify it? My solution will help you identify the device, or block the malicious device from accessing your network, outside of using tools to map your entire network and what protocols are running on what devices allowing you to fingerprint those devices. – Ramhound Apr 6 '16 at 15:04
  • I see many references online to Amazon using that OUI in both their Kindle and Fire product lines. Do you have a Kindle in your household, or an Amazon Fire TV, or something? – Spiff Apr 6 '16 at 20:42
4

[I had posted this as a comment, but I guess I should post it as an Answer.]

I see many references online to Amazon using that OUI in both their Kindle and Fire product lines. I'm guessing you have a Kindle in your household, or an Amazon Fire TV, or something like that.

  • I can confirm this: just tested with my old Kindle Keyboard. The name is also quite suspicious - it shows up as new-host :) – chronos Jul 13 '17 at 17:33
  • 1
    My Kindle Keyboard's MAC address starts with 28:ef:01 as well. – Erik Giberti Jan 23 '18 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.