Random Mac addresses popping up on the network

[Stin6667]

Good day,

 

Long story short, was working on something in the PFsense. And all of a suddent my main switch started wigging out on me, saying it was trying to adopt. By the time I figured out that something stole the ip address I had already did a factory rest as I didn't know what else to do. I manually set an Ip outside the DHCP range. And I got it working, then I started seeing random MAC add on the network, thinking I did something wrong, I rest it over and over again. The only thing I think could be causing this is if a port was open on the Pfsense. But I am not sure and I do not know how to check. 

Any help will me awesome

Thanks

P.s I am using UNIFI

[joshfrog]

Im not sure whats going on but could the mac addresses that have show up be the mac address for the network switch ports, i.e if you have a 24 port switch could it be showing you all 24 of the mac addresses for that switch?

[Stin6667]

6 minutes ago, joshfrog said:

Im not sure whats going on but could the mac addresses that have show up be the mac address for the network switch ports, i.e if you have a 24 port switch could it be showing you all 24 of the mac addresses for that switch?

Nope, They are all coming from one port and that port is connected to the Pfsense router. I have 3 small unifi switches "daisy chained" throughout the apt. I am thinking ( have no clue and I am spit balling) it is the MAC from a huge switch for the building.  Also I am not seeing 24 I am seeing over 100 MAC add

[joshfrog]

Its looks to be some sort of 24port switch because i counted and there is 24mac addresses that all start the same b4:a9:4f and it says Gbe as the experience so it makes me think they are all wired not wifi.
if its a switch for the building i would think not but maybe its setup in a stupidly weird way that you can see all the ports but i wouldnt think so.

 

I really dont know, you have a weird one there.

[Stin6667]

5 minutes ago, joshfrog said:

Its looks to be some sort of 24port switch because i counted and there is 24mac addresses that all start the same b4:a9:4f and it says Gbe as the experience so it makes me think they are all wired not wifi.
if its a switch for the building i would think not but maybe its setup in a stupidly weird way that you can see all the ports but i wouldnt think so.

 

I really dont know, you have a weird one there.

But It didn't do that till  the random Ip stealing. ( not sure what to call it as, the IP randomly changed. To my external IP address( at least I think it was, it started the same and nothing on my network has anything starting with 82 besides the my external IP)

[Stin6667]

54 minutes ago, joshfrog said:

Its looks to be some sort of 24port switch because i counted and there is 24mac addresses that all start the same b4:a9:4f and it says Gbe as the experience so it makes me think they are all wired not wifi.
if its a switch for the building i would think not but maybe its setup in a stupidly weird way that you can see all the ports but i wouldnt think so.

 

I really dont know, you have a weird one there.

After reverting to an old backup of PFsense it went back to normal

[Falcon1986]

On 6/3/2023 at 3:57 AM, Stin6667 said:

Nope, They are all coming from one port and that port is connected to the Pfsense router. I have 3 small unifi switches "daisy chained" throughout the apt. I am thinking ( have no clue and I am spit balling) it is the MAC from a huge switch for the building.  Also I am not seeing 24 I am seeing over 100 MAC add

Why is this happening in the first place? Is your internet connection shared with other users?

[Echothedolpin]

Are you sure you only have one device functioning as a DHCP server?

[Stin6667]

9 hours ago, Falcon1986 said:

Why is this happening in the first place? Is your internet connection shared with other users?

No, I wa trying to learn and test out vlanning, subnets, and I guess a little about DHCP  etc. Well, where I live ( I am not 100% sure) but when the guy that comes and installs the internet comes, he needs to go to the sever and turn on a connection for us. And I am assuming I some how got access to that. That is my best guess.

[Stin6667]

3 hours ago, Echothedolpin said:

Are you sure you only have one device functioning as a DHCP server?

I'm still learning here. but As I have it set up currently( with alot of mistakes so far) Yes, I have turn both Asus routers into AP's. BUt one or sometimes just stops sending an internet singnal. but other than that I don't think I have anything that can be a DHCP server. All my mini unifi switches have ips coming from the pfsense.

[TheGreatestGazoo]

I use an UDM-Pro and these random MACs started showing up under my clients list as well a couple of months ago. I restarted everything but it kept occurring and it appeared as though it was coming from one of the AP's since it showed connected to the same port on one of the Unifi switches that the AP was attached to. I removed some lower quality IoT devices from the network and the problem went away. I then added them back one at a time to see what may have caused the problem but after adding them all back, the problem never occurred again. So, I don't know why it happened or how it got fixed. My suspect device is a BluAir Air Purifier that is WiFi enabled and seems kind of sketchy - it's now on its own VLAN, but I still don't know for sure. This issue has appeared on the Unifi forums as well so I now suspect that it may be related to the switches rather than a client.