Use MAC to identify unknown hardware

Bluecube · 30 Aug 2020 at 11:17

I’ve been looking into my UDM statistics and was alarmed to see an unidentified device has downloaded gigabytes of data. Couldn’t say if it’s been transferred over the network and/ or from the Internet.

I’ve blocked it but I’d really like to find out what the hell it is especially as since I blocked it, there’s been no issues with anything plugged into my network. The unknown device also appears to be using Lets Encrypt which is worrying.

I only have a MAC address to go with. Is there any way to identify a piece of hardware from just the MAC address?

Any other pointers and advice would be appreciated too.

UnworthyBean · 30 Aug 2020 at 11:43

There are a few sites that will usually list the manufacturer, if you search mac vendors or mac address lookup and just pop it in to one of those sites.

I did it a while back when there was a few unknowns and it turned out to be legit things that I completely forgot about.

Bluecube · 30 Aug 2020 at 12:14

Good call. However, I’ve just tried a few of those websites and the MAC is unrecognised.

Terminal_Boy · 30 Aug 2020 at 12:32

Tried this one?

https://aruljohn.com/mac.pl

Bluecube · 30 Aug 2020 at 12:33

https://aruljohn.com/mac/0242C0A8011C

I did

Bluecube · 30 Aug 2020 at 13:35

Never mind. Finally sussed it out. It was a docker on my server. This explains the unrecognised MAC. The only strange thing is that the docker still worked when Blocked on the UDM. At least I know what it is now!