WiFi Intruder or something to do with Win 10 Updates?

Hi all

I’m in a quandary and need some expert help.

We’re in Brisbane, Australia. This query is about whether an unknown device that connected to our WiFi hotspot is just an intruder who’s discovered our password or some virtual device to do with Win 10 updates.

My family has a Netgear, BigPond Wi-Fi 4G Advanced II AirCard 790S hotspot. A day or so ago, an unknown device was shown on the online manager page. Being alone, and knowing no other devices were on, I panicked and, without noting the device details, I just got off the internet. Later, when I’d thought about it and got back on to see if it re-joined and snare its details, it didn't re-appear.

Today (15/8/2016), it reappeared - my wife was also online this time. I checked with her what devices she knew were on and the suspect one seemed definitely an "extra". So, this time, I logged in to the WiFi manager, got the “stranger’s” details and blocked it.

Devices connected to our hotspot are shown, I gather, by their “device name” which in my case is the name I gave my laptop when setting it up. My wife’s devices seem to have default names which I imagine devices take if you don’t give them a custom name. In the connected devices panel, the “stranger’s” showed as a 12-digit Mac identifier (i.e., paired numbers and/or letters separated by hyphens). The online WiFi manager page, if you log into it, will also show a device’s IP identifier. In this case, the “stranger’s” was “IP: 0.0.0.0.” I looked up the Mac number on a site called "Arul's Utilities" and it told me the manufacturer (Western Digital, 1599 North Broadway, Rochester Mn 55906, United States) which doesn't mean anything to me.

I next googled "IP: 0.0.0.0" but I have to admit not really understanding a damn thing I read. “Hosts” and "all IPv4 addresses on the local machine" left my head swimming. (Yes, I’m an old person and I’m just not computer-literate to that extent). But, it put a suspicion in my mind that I'd blocked something that's part of our home network to do with Win 10 updating. If so, what?? I’m inclined to doubt this since the “stranger” is still blocked, and Security Update for Windows 10 Version 1511 for x64-based Systems (KB3172729) has just successfully downloaded.

Anyhow, my gratitude for any patient and kind soul who can throw any light on the situation.

Yours

ausgumbie

TairikuOkami said:

Yes, 0.0.0.0 is used for listening on the local computer, but since you say, it has MAC identifier, it might a device, which tried to connect to your hotspot, probably automatically and failed, so it got assigned IP 0.0.0.0. ...

Thanks TairikuOkami

I had a quick look at the "Troubleshooting DHCP Clients" article, again thanks. I have a couple of questions. Please bear with me - I really am low in computer knowledge and terminology.

When you say "0.0.0.0 is used for listening on the local computer" do you mean my computer (being the local computer) is listening (through its ports) to others which are trying to join the network OR that computers outside the home network are listening to my computer? (Your CurrPorts screenshot seems to suggest 0.0.0.0 is assigned to others listening to my computer).

The other bit I didn't quite follow was "it might be a device which tried to connect automatically but failed". I'm not sure that would then appear on the list of connected devices (i.e., if it hadn't managed to connect). I'd thought the AC790's online manager only registered devices that had managed to connect.

If this was a device that had managed to establish a connection, could the 0.0.0.0 signify the device had had its IP address somehow masked?

Many thanks

ausgumbie

Thanks TairikuOkami

Sorry tardy with reply - other things delayed me.

Many thanks for the info which I will follow up.

Cheers

ausgumbie

If the MAC address manufacturer is Western Digital, that probably means it's a wireless NAS or "Cloud" hard drive. Do you have one of those? Perhaps if you listed the MAC address we might be able to help narrow it down more.

0.0.0.0 on a router probably means that no IP Address was assigned, which means it can't do anything on the network.

Hi both.

I have a painful admission - my wife pointed out to me a little device sitting on the tv set. "Could your hacker be that?" she asked. Today, late in the peace, I checked it out. The device is a WD TV Live Streaming Media Player. On the back is a details sheet - with the MAC number listed on it. The same number as my "hacker".

Oh, well, at least I've learned a lot about WiFi security, but - I very much feel like a goose! My apologies.

I live and learn

ausgumbie

Hi TairikuOkami

Thanks for your kind words. I'll certainly keep that attitude and I'm certainly going to follow your suggestion about WNW and (especially) CurrPorts.

Cheers

ausgumbie

ausgumbie said:

Today, late in the peace, I checked it out. The device is a WD TV Live Streaming Media Player. On the back is a details sheet - with the MAC number listed on it. The same number as my "hacker".

Ahh.. I'd forgotten that WD was in that market, yeah good catch by your wife :)