Re: Nighthawk AX8/RAX80 - Spoofed/Altered MAC Address Spamming Logs

Kroozer · ‎2021-12-24

I have an issue that I noticed a couple months ago.

My logs are filled with a "spoofed" MAC address attempting to connect every few seconds. (I have had 1,007 entries of "spoofed" MAC address attempting to connect in my logs)

When this happens, the logs are filled with this "spoofed" MAC address in three hours.

Here is an example (I have randomized the MAC address):

[DHCP IP: (192.168.1.3)] to MAC address 05:17:A5:E5:A4:98, Friday, Oct 29,2021 12:31:34

DHCP IP: (192.168.1.3)] to MAC address 05:17:A5:E5:A4:98, Friday, Oct 29,2021 12:31:44

DHCP IP: (192.168.1.3)] to MAC address 05:17:A5:E5:A4:98, Friday, Oct 29,2021 12:31:54

I checked all of my devices and found that my DIRECTV DVR had the NEARLY the same MAC adddress.

Example:

Actual MAC address: 05:17:A5:E5:A4:98

Variant MAC address: 04:17:A5:E5:A4:97

(These are "fake" MAC addresses)

The middle four numbers are identical, with the first and last numbers off by one digit.

I have blocked the "spoofed/misread/variant" MAC address, but still have connection attempts in logs. The only way I have been able to stop the flood of the spoofed MAC address was to disconnect DIRECTV from the router.

Has anyone experienced this issue?

FURRYe38 · ‎2021-12-24

Something you might ask DTV about.

I know that Apple has implemented that Private Address which changes MAC addresss on there devices. Possible DTV is doing something odd here.

Kroozer · ‎2021-12-24

I spoke with DIRECTV and was told the "solution" was to change my wifi password.

I explained that this was NOT the issue, as the "spoofed" MAC address was only off from the the DIRECTV MAC address by one digit in first and last number.

I also explained that this issue did not occur when I disconnected DIRECTV from the router.

She paitiently told me that she understood, but that I needed to change the wifi password because this was the next step on her troubleshooting guide.

I will call back after the holidays.

FURRYe38 · ‎2021-12-24

Ya first line support doesn't do much. I just got thru ATT blocked phone hell for past two weeks. Once phone is reportes lost, then you find it and get it verifiied found and belongs to you, ATT can't seem to remove it from being blocked. I had to get the phone replaced. What a S*** show that was. IF they had said we can't remove the block and take the replacement two weeks ago, I could have avoided all the hassles.