unknown node on my LAN

[mikewebb99]

We recently changed from ATT DSL in AUG-Sep. all has been going along fine untill about the firt of November.  Our LAN became unresponsive, and I could not log onto the Comcast Router (A Cisco DPC3939). I disconnected everything from the Gateway, and did a Hard reset. After this I was able to login to the router and re-configure it to meet my needs, which mainly meant inserting my own SSID's and changing the address over to a 192.168.1.1 vs 10.0.0.1.

Being curious about what had happened; I started checking the "Stuff" in my LAN... We have 2 HP Touch smart computers, a Synology NAS,Cannon 8220 Printer, and several other things. While inspecting the LAN side of our network, I noticed a node at 192.168.1.254. I can Ping it without problem, but scanning it with a network scanner, looking for open ports, etc, I don't seem to be able to contact this node in any way other than Ping.

This unknown node has a suspicious MAC address of : 00:05:04:03:02:01. The first 3 hex groups point to Naray Information and Communication Enterprise, which is a actual electronics mfgr in Taiwan. 

Can anyone explain where this is coming from?  Is this, perhaps part of the VOIP capabilities (which we do not use)?? Is this part of the XfinityWIFI hot spot service I have seen so much about??  I am a little uneasy with some unknown node on my network, in light of the meltdown we had at the beginning of the month.

Thanks for your time, and any help you can lend

Mike Webb (aka Woody99)

[JayInAlg]

Comcast never uses 192.168.1.254, but AT&T uses that for the default gateway on their equipment.  Did you disconnect the AT&T gateway when you changed over?

Have you tried to open the address in your browser?  http://192.168.1.254

Technincally everyting on your network should be on the 10.0.0.x subnet and nothing left on 192.168.1.x

[mikewebb99]

Jay;

"Comcast never uses 192.168.1.254"

While it may be that Comcast routers come with the address set to 10.0.0.1, it is not the only private address range available to use. Below are the ranges designated as private and non-routable by roc 1918

10.0.0.0 through 10.255.255.255
172.16.0.0 through 172.31.255.255
192.168.0.0 through 192.168.255.255

What Comcast or AT&T use as default has no bearing on what a client sets for address ranges as long as the rules are followed.

As part of migrating my network over to Comcast, I set the router address range to fit my existing network, which contains some static addresses,as well as some dynamic addresses, and yes I thought to remove my DSL router before connecting the Comcast router.

"Have you tried to open the address in your browser? http://192.168.1.254"

Yes. The address responds to ping, but not to telnet,ftp or to attempts to connect via a browser. Scanning the address for open ports is also unproductive.

"Technically everything on your network should be on the 10.0.0.x subnet and nothing left on 192.168.1.x"

Technically this is incorrect. The addresses must conform to the range of private addresses the client has selected, along with the subnet mask provided (in my case 255.255.255.0)

My main question remains what is this node on my LAN, and what is it doing in my LAN


mike

PS: I had occasion to visit my son in laws home for a family thing...I scanned his network and noted that he has the same node, at the same address, with the same suspicious MAC address of: 00:05:04:03:02:01

[Di77]

Hi Mike

I am a longtime comcast customer that is also having the same problem.  However the unknown node with MAC address 00:05:04:03:02:01 shows on 10.0.0.254 since I never changed the default address on my DPC3939.  I can also ping it but cannot access it.   I had comcast switch out the gateway since beside the unknown node, the gateway default address changes from 10.0.0.1 to 172.16.12.1 occasionally on its own. The change in default address never last for long and started in October.   Gateway support cannot explain either problem and the tech that brought out the new gateway blamed my computer.  He said that since the problem is with my wired connection, it had to my computer since that connection could not be hacked. Have you spoken to anyone at Comcast about it? 

Di

[mikewebb99 · Accepted solution]

---

Hi Di;

I have not spoken to anyone at Comcast. I thought I would ask the question in this forum, figuring that Comcast support looks at these entries, and would have a quick answer. I suspect that this "rouge" node at X.X.X.254 has something to do with Comcast's Phone or home monitoring services, but no one seems to want to confirm or deny that.

Based on the response  to my question, I believe I will replace the DPC3939 with my own Equipment.  I will probably replace the Gateway with a Netgear c3700. This will be a more expensive solution in the short term, but will save rental fee's once I recoup the purchase price... I had the DSL version of this gateway, for about 6-7 years, and it was rock solid..

I am also in the process of asking this question in an external Computer Support Forum, and will respond with any useful info from there..

Mike

[Di77]

Hi Mike

So much for Comcast answering either of us about this problem. I guess we expected too much.

[twistedsister_1]

Hi all,

 I have this same unknown node and I was thinking it may be the phone as well. Im trying to secure my network better and I was checking the configuration settings in the gateway. something keeps intruding my laptop that I use the most.

[geek46]

FWIW, I have unknown nodes and they are my wife's Iphone and my Galaxy S4....traced down using the MAC addresses of each...   just saying....

-=Ray=-

[puterbrain]

I found the same unknown node on my network.  I work in networking.  I have my network set to the private 192.x.x.x range instead of the 10.x.x.x range.  I eliminated all other nodes besides the Comcast unit.  I even ran a port scan against the 192.168.1.254 address and it doesn't respond on anything but ping.  I am guessing it has something to do with the extra SSID they started piggy backing on our modems as part of their romaing Wi-Fi app.  I plan to give them a call for what good it will do,  I will most likely have to replace their modem with one I buy.

[xrobwx]

Thanks Ray, but those are not unknown. I also have my wif'es Ipod,cell phone etc on my network. those are identified. It's the one ip 10.0.0.254 with MAC 00:05:04:03:02:01 that is in question here. Also, funny it's not listed within the Comcast router connected devices section. (not mine anyway) Only using fing (andriod phone app) or Nirsoft's Wireless Network Viewer can I see this IP and MAC. I have blocked the MAC adrress from within theComcast routers admin page but it still shows up in fing and Nirsofts WNV. 

I should also add since the OP had ATT DSL... My Father, next door has ATT DSL.

[wvzr1]

I would think the .254 is for provisioning of "HOME SECURITY". I believe that a Gateway device when originally provisioned would display 10.0.0.2 through .253. I believe they also use a router cascaded from the Gateway for the service. I don't have the service but I'd think it's quite likely.

Do either of you have HOME SECURITY?

---

@xrobwx wrote:

Thanks Ray, but those are not unknown. I also have my wif'es Ipod,cell phone etc on my network. those are identified. It's the one ip 10.0.0.254 with MAC 00:05:04:03:02:01 that is in question here. Also, funny it's not listed within the Comcast router connected devices section. (not mine anyway) Only using fing (andriod phone app) or Nirsoft's Wireless Network Viewer can I see this IP and MAC. I have blocked the MAC adrress from within theComcast routers admin page but it still shows up in fing and Nirsofts WNV. 

I should also add since the OP had ATT DSL... My Father, next door has ATT DSL.

---

[xrobwx]

No home security with Comcast.

[nathank1989]

Did you ever find out what it was? I too have it. I'm sure it's harmless, but anyone should be skeptical of a mysterious device on your secure network.
I just got a Cisco XB3 gateway modem from comcast, noticed it after everything was all set up.

[xrobwx]

It's still there and I haven't found out what it is. I was hoping one of the Comcast moderators would chime in and help us. I too have the XB3 modem. If I come across a solution or at best an explanation, I will post it here.

http://s7.postimg.org/4ehp3di2j/wireless_network_watcher.jpg

[HarleySchwartz]

10.0.0.254 = inside ip of comcast ASA firewall 

Should answer all your questions.


My experiance = ICND 1 & 2 

[Dschu53]

I c last post was January, I have node, any one figure this out yet? Where it comes from? Why is it there?

[wvzr1]

It has been answered. It's the Comcast Internal Firewall - FIREWALL