Unknown Netgear IP address on network (CG3000V2)

[Czarnik]

Recently got a new cable modem from Optus (CG3000V2) and enjoy using Netgear Geni, but confused by an unknown device that keeps appearing at the same IP address (192.168.0.5). Recently checked Norton Network Map and find the same device. Have a sneaking suspicion it's related to the CG3000V2 itself (so close in MAC address isn't it!)

Since I'm not sure about posting full MAC addresses, I will remove the last 2 pairs.

The 1st device is the unknown

Unknown device 80:37:73:9E:xx:xx wired 192.168.0.5 ?seems always same IP (1st 6 indicate Netgear device)
Netgear CG3000v2 cable modem/rtr 80:37:73:9E:xx:xx no IP CM MAC (from dev label)
Netgear CG3000v2 cable modem/rtr 80:37:73:9E:xx:xx no IP MTA MAC (from dev label)
Netgear CG3000v2 cable modem/rtr 80:37:73:9E:xx:xx both 192.168.0.1 gateway

Look forward to hearing any suggestions as to how to identify this?
Is posting full MAC addresses here recommended? Will it help?

Thanks,
Larry
2015MY17 21:05 Sydney Australia

[fordem]

First - and let me make it clear, this is just my opinion, there is no reason to conceal the MAC addresses, all it does is make assisting you more challenging. The MAC addresses of your devices are "invisible" outside of your network, or the network to which the device is connected - in most cases, concealing it provides no additional security, and whilst you've probably been told it is unique to your device, that is not entirely true (I have seen Ethernet cards with the same MAC address), and it is also possible (and in fact a trivial task) to "spoof" MAC addresses because the standards do allow for what is termed a "locally administered address". Second - you seem to be suggesting that some part of the ip address indicates a Netgear device - this is incorrect - the IP address is what's called a logical address, the 192.168.0.x network is probably the most commonly used private network range. The first six characters of the MAC address form what is known as the OUI (Organisationally Unique Identifier) and they can be used to get an idea of who manufactured the device, but this should not be considered as definitive - in addition to the ease with which the MAC can be changed, you will find consumer grade products from many manufacturers showing OUIs from apparently unrelated companies - as an example, my Netgear printservers show up as "SERCOMM", and the HP Pavilion laptop I am using is "UNIVERSAL GLOBAL SCIENTIFIC", my daughter's Dell shows up as "Intel" (it does have an Intel wireless card), and I'm also seeing on my network a "Quanta computer", and two "Liteon Technology" which are all Dell laptops (I recognize the NetBEUI names)

[Czarnik]

Fordem,
Thanks for your quick reply
Sorry, was NOT suggesting the IP address indicated a Netgear device.
WAS suggesting the 1st 6 characters were the OUI and that they indicated it was Netgear device. Thanks for letting me know that this is not definitive.

However the MAC address is VERY close to that of the 2 on the CG3000V2 itself. And funnily enough the MAC address that appears on 192.168.0.1 Gateway IP address is NOT one of the two on the device label. But it IS as I said close to the unidentified device. (hence my providing the 4 albeit partially masked MAC addresses.)

That said, what CAN I do to simply determine what the device IS. Does the CG3000V2 use another IP address in any way?

One simple things didn't work to find out what the device is. Putting the IP address in a browser just came up as not available.

So do you have any simple techniques that could help me identify the device?
Thanks,
Larry
2015MY18 07:30 Sydney

[fordem]

Primarily because of the ip address you mentioned (192.168.0.5), I doubt that it has anything to do with the router, and I suspect the common OUI is nothing more than a coincidence. Most routers have only two MAC addresses, one for each network interface (WAN & LAN), it is theoretically possible for it to have more if it is a wireless router, but in practice the wireless related interfaces will typically show the same ip as the router's LAN interface, or, if the router allows a guest network, an address in a different network range, so the x.x.x.5 suggests a completely different device.

[Czarnik]

Thanks again. Understand. So back to the original problem, what is the device?

OK, a few things I did since. Logged in direct to router on web interface (192.168.0.1) and the questioned IP 192.168.0.5 is NOT there. (using either basic or advanced menu items for map)

Netgear Genie and Norton Network Map both refresh to have the device on IP 192,168.0.5 and the MAC id (did you want the specific one? It's only the last 1 position (2 characters) different than the Netgear CG3000V2.)

Do you know how the CG300V2 acts / reacts? as in does it create a "ghost" device?

Thanks in advance,
Larry
2015MY18 11:50

[fordem]

Use ping from the windows command prompt to ping the ip address, if it does not respond, it may not exist - most devices will respond to a ping request, unless there is a firewall blocking the request.

I don't need the MAC, there's no definitive way to determine the device from it, and not being a user of either Netgear Genie or Norton Network Map, I can't tell you how either one works - experience with Microsoft's LLDP (link layer discovery protocol) network mapping, which is what I suspect is being used by Genie & Norton, has shown me that the technology is perhaps not mature enough to be considered reliable - I have yet to see it show an accurate map (a quick check this morning shows one of my three switches and a printer missing, and a server showing up twice).

Many routers are also not reliable in their presentation of attached or connected devices - there are two methods generally used to gather the information, both with their quirks, and I have no idea which one the CG3000 uses.

If this sounds like I have little faith in these technologies, it's because I don't - I've investigated the quirks, I know why they don't work, I don't know of a guaranteed reliable way, and I just don't loose sleep over them.

If I want to know what is on my network (usually so I can find where it is, I will either use FING (which runs on an Android device) for a quick & easy check, or PacketTrap's network tools.

[Czarnik]

Fordem,
Ok using fing i got a response from telnet (port 23).
I used a telnet client on 192.168.0.5 port 23 and got a login prompt. Since I don't know the device I did a guest guest and admin no password and it failed. Since I am WAY out of my depth here I have no idea how to proceed. The telnet sw (vSSH Lite for the Mac) only gave me this display briefly but include it to see if it helps you decipher what the device is.

Here is a link to the screenshot - https://www.dropbox.com/s/zx11m7r6i97yfvc/Screenshot%202015-05-19%2010.26.43.png?dl=0

does that tell you anything about the device or does it only set up display parameters?
Thanks,
Larry
2015MY19 10:30 Sydney

[fordem]

Sorry, the telnet details don't give me any clues, although it does confirm that there is a device at that address. Try switching everything off except the router and the device you're running fing on, and then rescan - if it disappears, turn the devices on one by one, rescanning in between and see if you can locate it that way. If you still get a response after switching everything off, unplug all the LAN cables from the router & rescan, if it is still there, change the encryption keys & rescan.

[Hjzamm]

Optus has sent me like 4 Cg3000v2 on Fing there is an unknown ip. Along with the name netgear. When I scan the ports it is using it is using telnet. The router Optus gives everyone should be illegal. It has more security flaws in it then anything. An Optus refused to disable telnet.. If you did guess it I am hacked, not just any hack BLACK HAT HACKER aka cracker, it literally couldn't be any worse. An all Optus does is send out there useless routers that doesn't help at all. So if anyone knows how to completely remove telnet I'd appreciate it. I've only been with Optus for about 4 months now. An what I no is they don't care about people's security an there router exploites which was also an artical last year in the age making Optus router look bad yet they still give the router to everyone. By looking at the Fing app everything seems sweet bout there is nothing sweet about opened ports because of a useless router & getting hacked! As long as Optus gets paid that's all that matters right 😃 grr

[nhann]

Hi Hjzamm,

The firmware on the CG3000v2 is provisioned by your ISP, please contact your ISP to configure your settings.

Please let me know if you need further assistance.

Regards,
NhanN

[savstars]

Hey guys,

I can tell you that the 192.168.0.5 is actually the in built USB storage/NAS feature, and I believe it is also used in the in built media server functionality.  I would love to know how to change that IP address as it is conflicting with my real NAS.

Any ideas on how to do that?

[TJAUS]

I've had the same experience and have searched a few different forums. One answer i got was that 192.168.0.5 (with a very similar MAC as the 192.168.0.1) is the file sharing IP for the CG3000v2.

Cheers

Tony