topic Re: Unknown device trying to authenticate wirelessly that is failing in Wireless

Unknown device trying to authenticate wirelessly that is failing

Doopzzy — Fri, 11 Feb 2022 19:36:14 GMT

There is a user in my company that is receiving constant lockout, after investigating there is a device that is using his username to try and authenticate but wrong password to our wireless meraki. We can not locate the device we only have the MAC that is trying to authenticate. The people on premise have tried to locate the device, but no success. I came on here to try and see if anyone has a solution that can be done on our network.

Re: Unknown device trying to authenticate wirelessly that is failing

balaji.bandi — Fri, 11 Feb 2022 19:50:44 GMT

May you need to Look what AP it is trying to connect then physically need to locate that device and remove it.

https://documentation.meraki.com/General_Administration/Inventory_and_Devices/Search_Tool

Re: Unknown device trying to authenticate wirelessly that is failing

Scott Fella — Fri, 11 Feb 2022 19:52:08 GMT

Do you have a radius server in which you can look at the logs and see which ap that device is associating to? I have seen this happen when the user has other devices and forgets on has cached credentials.

Re: Unknown device trying to authenticate wirelessly that is failing

Doopzzy — Fri, 11 Feb 2022 19:58:48 GMT

Yeah I should have included that but we do know which AP it is exactly. It most likely is cached credentials, but the user does not know which device it could be. He is a tech so he could have helped other users and accidently stored his.

Re: Unknown device trying to authenticate wirelessly that is failing

Doopzzy — Fri, 11 Feb 2022 19:59:25 GMT

We do know which AP it is, but the tech in that office can not locate anything with the matching MAC.

Re: Unknown device trying to authenticate wirelessly that is failing

balaji.bandi — Fri, 11 Feb 2022 20:06:02 GMT

this is hard to find, its like some one plannted a sniff tool, where we dont know.

best to block the MAC address.

Re: Unknown device trying to authenticate wirelessly that is failing

Scott Fella — Fri, 11 Feb 2022 20:07:21 GMT

Can't you just ban that device mac address?

Re: Unknown device trying to authenticate wirelessly that is failing

Leo Laohoo — Sat, 12 Feb 2022 00:24:39 GMT

I am with @Scott Fella. Ban/block the MAC address.
The wireless device will turn up eventually.

Re: Unknown device trying to authenticate wirelessly that is failing

Haydn Andrews — Sun, 13 Feb 2022 21:04:36 GMT

Like others have said, utilise block mac address to prevent the device authenticating and locking the user out.

As to help with what device it is put the mac address into https://macvendors.com/ it will give you some idea of the manufacturer of the device.

After a couple weeks, unblock the device if it keeps happening from that mac address at least you know its connected to a power source.

If you have access to NetAllys Aircheck, you could use the find device tool to find the device.