cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Please be advised, the GuideMe Wizard is no longer available on the Small Business Support Community. For search capability please use the community search field to find content related to Cisco Small Business documents, videos, and discussions.
628
Views
3
Helpful
13
Replies
Beginner

Mystery Host Discoveries

At one of our sites, OnPlus has discovered a couple of devices that cannot be explained.  All deivces connected to switchports on the LAN are properly discovered.  These "Mystery" devices are in addition to the known devices.

There are two of them and are reported with MAC addresses but no IP addresses.  They are reported as Dell-manufactured interfaces.

There are Dell workstations on the LAN, but they have single interfaces which are known to OnPlus.

Any thoughts on what is happening?

TIA

Everyone's tags (3)
13 REPLIES 13
Enthusiast

Mystery Host Discoveries

Hi Curt,

That is interesting. Could you check the DHCP server to see if those MACs match any IPs and try accessing the device? Are these devices that were connected previously?

Could send me a Private Message with the site name?

Thanks,

The OnPlus Team

Beginner

Mystery Host Discoveries

aqazi:

Thanks for the prompt response.

  • There are no active leases on DHCP.
  • There were no entries for the devices is in ARP table at the time I checked.
  • They are reported as Dell Macs and the only two Dell devices here are accounted for (as different MAC addresses), so prior connection would not be applicable.
  • As suggested by sdeftink (below), there is a Cisco wireless (WPA2), but (unless hacked) only adroid wireless, not ethernet, connect thereto.

I will send site name via PM.

Thank you.

Contributor

Re: Mystery Host Discoveries

So, just to double check, it's not possible that any Dell Laptops have been connected to the WPA2 Wireless down there? I'm also assuming that wireless isn't also broadcasting a public access wireless of any kind, even on a different VLAN?

Sent from Cisco Technical Support iPhone App

Shawn Eftink CCNA/CCDA Please rate all helpful posts and mark correct answers to assist others searching for solutions in the community.
Contributor

Re: Mystery Host Discoveries

Here's another thought, and perhaps Aqib can look into this.

Is the WPA2 SSID broadcasted? If so, Aqib, if someone attempts to attach, would it be possible that OnPlus picks up the MAC while the device is trying to negotiate but never gets an IP because one is never issued because it fails auth?

Sent from Cisco Technical Support iPhone App

Shawn Eftink CCNA/CCDA Please rate all helpful posts and mark correct answers to assist others searching for solutions in the community.
Enthusiast

Re: Mystery Host Discoveries

Thanks Curt, I have the site name now.

Do I have your permission to pull logs from this site?

Thanks,

The OnPlus Team

Beginner

Re: Mystery Host Discoveries

Permission granted.

C

Y

Enthusiast

Re: Mystery Host Discoveries

Thanks Curt. We will investigate this issue and provide an update once we have more information.

Contributor

Mystery Host Discoveries

I'm assuming the Mystery Hosts are showing offline correct?

Some thoughts from our experiences:

1) Is there wireless at that location?  If so, we've seen where a device might show up on the wireless network but show as offline.

2) How large is the environment?  For example, we have a bench DMZ that is a VLAN in one of our switches that we utilize for clients systems that are in our office being worked on.  OnPlus picks them up sometimes as well.

Perhaps those don't apply, but thought I'd throw them out there.

Shawn Eftink CCNA/CCDA Please rate all helpful posts and mark correct answers to assist others searching for solutions in the community.
Contributor

Re: Mystery Host Discoveries

Curt,

Another thought, as you troubleshoot this down, is to drill into the mystery device, select the Info tab and scroll down to the incept_date and last_seen rows.  In some of the instances that I've noticed, the dates are exactly the same and may have been upwards of 7+ days ago.

Aqib,

I don't know what the current default setting is for OnPlus on how many times the ON100 must see a device before it adds it, but it might be worth incrementing it up in a future release to deminish false positives.

Shawn Eftink CCNA/CCDA Please rate all helpful posts and mark correct answers to assist others searching for solutions in the community.
Enthusiast

Re: Mystery Host Discoveries

Thanks Shawn, I'll look into that also.

Beginner

Re: Mystery Host Discoveries

I have found itunes to be the cause of this, I have duplicated the issue in the lab with a dell and when I launch itunes the mystery device(s) shows up.

Cisco Employee

Re: Mystery Host Discoveries

Kevin, very interesting observation. I wonder if iTunes is advertising content via UPNP/DLNA using the (possibly wrong) MAC address of another virtual or physical network inferface on that Windows machine. Does the MAC OUI of the mystery device also appear as Dell in your case?

-mike

Cisco Employee

Re: Mystery Host Discoveries

An update, another engineer familiar with this issue informs me that we believe we've found the root cause of the issue in the ON100 discovery code and that a fix has been committed which could be rolled out to the OnPlus service as early as this week.