Orbi RBR50 About device names

[ron111157]

Orbi RBR50v2, two satellites.  v2.7.4.24. Mac systems

Question about device names in the App

I always give a new device a name and have had no issues there. Recently I added a new smart hub, (Aqara) named it and most times the name I set it shown.  What troubles me is quite often the name shows as a persons name which I do not know. Very odd!  Its the only device name that has done that.

Why is this and I should I be concerned?

[CrimpOn]

Does the MAC address remain constant?

[ron111157]

 I have not noticed if the MAC is the same. I do know the IP is.  Its reserved.

Right now the MAC is correct according to the paperwork. 

Next time the name changes I will double check the MAC as well.

Thanks

[CrimpOn]

Was the IP address reserved using the Orbi app or the web browser interface?

[ron111157]

If I understand you correctly I used the web (my computer) to reserve the IP and not the phone App.

I did find the device in question in the allowed but not connected section of connected device tab.

on the computer is was 

name... unknown 

MAC.     00:12:34:56:78:90

IP... on the app as another IP

but on my phone it was

name...Camille Bauer

MAC 00:12:34:56:78:90

IP.... as assigned

[ron111157]

Thats not the correct MAC

Now that I see that MAC it stands out like a sore thumb!

[ron111157]

Ok, so I deleted the odd MAC 00:12:34:56:78:90 from the authorized but not connected list.  Next time looked it had returned.  Sometimes it has an Unknown name and sometimes Camille Bauer.   What causes his??

One time it. even appeared like this. One reserved IP with two MACs

[michaelkenward]

---

@ron111157 wrote:

Ok, so I deleted the odd MAC 00:12:34:56:78:90 from the authorized but not connected list.  Next time looked it had returned.  Sometimes it has an Unknown name and sometimes Camille Bauer.   What causes his??

One time it. even appeared like this. One reserved IP with two MACs

---

That Mac address resolves to Camille Bauer. Swiss company that seems to make network gear.

MAC Address Vendor Lookup: MAC/OUI/IAB/IEEE Vendor Manufacturer Search

There can be "hidden" devices on a network that you don't recognise. Sometimes a device has more than one Mac address, for WiFi and hard wired, for example.

Might be worth checking the devices you own. Could be some Internet of Things (IoT) thing

[ron111157]

Thanks.

I had looked up that MAC and saw it was a Swiss company and the Mac was "valid"?

and that MAC goes all the way back to 2004.

Question is what's its purpose and why is a Swiss Co Mac in a Chinese Product?

The hub in question is a Aqara M2 and once it was removed the MAC went away so it is definitely the culprit.  It connects by ethernet but is set up via a phone so it must have both ethernet and wireless.  

Thing is both MACs, and the same IP show up in the Orbi app as wired connections. 

I guess the big question is "is this product SAFE !" 

Right now I have it blocked but rather not be there at all

[CrimpOn]

The product information for the M2 hub indicates that it can connect with both Ethernet and 2.4G WiFi.  If Ethernet connection is convenient, most "Old Timers" would prefer to use that method.  Having it connected both ways may lead to unexpected problems.

Determining manufacturers from MAC addresses is a complicated process, and it is not surprising that there could be errors or confusing results.

"Is it safe?"  I'd say, almost certainly so.

[ron111157]

  I would agree It should be an either/or to connect and not both. I always opt for ethernet when it's close by. Oh, and Yes I am a old timer, lol

   Thing is I see no evidence of a wireless signal at my router for the Hub. Maybe I'll disconnect the ethernet an see what happens.  Pretty sure I won't see it as having a MAC of 00:12:34:56:78:90 but who knows.   That is just a Odd MAC.  

[ron111157]

So I am guessing from the few responses that this is "probably" not an issue.

  I contacted Aqara and their support was adamant the MAC was not coming from their Hub and I had made a mistake somehow.

 Also some have suggested it "may" be the wireless MAC showing,  BUT whenever I see that MAC show up it always says it is a Wired connection even though I already have one wired connection shown.  Note: the hub is only a 2.4G or wired unit, no 5G.

Last before I move on one last question. If I blocked the MAC in question WHY would is show up again after being blocked?

This is from my weekly log

[Access Control] Device AQARA-HUB-M2 with MAC address 00:12:34:56:78:90 is allowed to acce, Friday, March 17, 2023 01:18:02

[michaelkenward]

---

@ron111157 wrote:

 Pretty sure I won't see it as having a MAC of 00:12:34:56:78:90 but who knows.   That is just a Odd MAC.  

---

You will find lots of odd Mac addresses on things Made in China. Netgear, for example, although it has moved a lot to Vietnam.

With most things "Made in China" until recently it might be hard to find a Swiss gadget made in Switzerland.

Products Measuring And Testing Technology - Camille Bauer Metrawatt AG

[TC_in_Montana]

---

@ron111157 wrote:

So I am guessing from the few responses that this is "probably" not an issue.

Last before I move on one last question. If I blocked the MAC in question WHY would is show up again after being blocked?

This is from my weekly log

[Access Control] Device AQARA-HUB-M2 with MAC address 00:12:34:56:78:90 is allowed to acce, Friday, March 17, 2023 01:18:02

---

I'm thinking that blocking by MAC in Access Control setting works on wireless devices, not wired.   

If you want to block Wired Devices from connecting to your network, you would accomplish that by not plugging it to your network.

[CrimpOn]

Another possibility might be the definition of "Blocked".  i.e.

There may be a difference between a device being physically connected to the network and the device being able to do anything on the network.

How about testing with some Ethernet device that is well known, such as a printer or laptop.

• With Access Control enabled,
• Block the device.
• Verify using Access Control and the log file that the device is connected,  yet shows as Blocked.
• Try to perform some communication with the device, such as:
  • Ping the device.
  • Send something to the printer.
  • Use the device to ping some other device on the network.
  • Use the device to access the internet.

[ron111157]

@TC_in_Montana 

I'm thinking that blocking by MAC in Access Control setting works on wireless devices, not wired.   

That would make logical sense however look at this

It clearly says Wired connection.  so either

1. It is misidentified as wired when it is actually wireless

2. One ethernet port has 2 MACs which should not be

Either way it was Blocked so should not of been given Access as the log states.

[ron111157]

  @CrimpOn 

 I will test that theory on one of my ethernet connected items.

I have done blocking often with many wireless devices and when they are connected and blocked basically nothing works on them. 

[TC_in_Montana]

---

@ron111157 wrote:

@TC_in_Montana 

I'm thinking that blocking by MAC in Access Control setting works on wireless devices, not wired.   

That would make logical sense however look at this

It clearly says Wired connection.  so either

1. It is misidentified as wired when it is actually wireless

2. One ethernet port has 2 MACs which should not be

Either way it was Blocked so should not of been given Access as the log states.

---

I agree completely that I shows "Wired" within the block list - but looking through various Knowledge Base articles on Access Control -   some specifically state it's used for Wireless connectivity, some say Wired/Wireless - so it may or may not work as expected - based on which KB article you read.   I've used other blocks - like blocking websites on NG's products - and the router reports that it is doing so - but really doesn't.  So sometimes things report correctly, sometimes they do not.   

Again, since it is WIRED (which you say it is and the system says it is) -  the best way to keep it from connecting to your network - is to not PHYSICALLY connect it to your network.

[CrimpOn]

Today is "Fun with Orbi Day".  I, also, experimented with using Access Control to block a wired device (Epson printer):

Results were puzzling.  Even though Access Control and Attached Devices clearly show the printer as Blocked:

• I could print to the printer.
• I could use a web browser to access the printer control panel.

However, when I used the actual printer controls to search for firmware update, the printer complained that it could not reach the internet.  Unblock the printer and it searches for firmware update just fine (at the latest already).  I will block a desktop computer next and see what happens.

The preliminary conclusion thus far is that "Blocked" is an ambiguous term, and almost certainly does not match what one might expect. i.e. the blocked device cannot originate a TCP connection, but it can respond to a connection established by an Allowed device on the network.

More to come....

[ron111157]

  Well that don't give a warm fuzzy knowing a product may or may not be working as it says it is.  

 Problem is I use that hub for smart home related device.

it can be connected 2.4G wireless or ethernet.   I went with ethernet.

 so IF that is a wired connection then that ethernet port has 2 MACs!  TWO

 I noticed it because I had 2 entries for one IP. Both wired and were connected at the same time.

 The more likely answer it is actually wireless, not wired.  

[CrimpOn]

MUCH clearer now.  Wired devices are different from WiFi devices in one important way: they are connected to the Orbi Ethernet switch module. Since (forever?) switch modules "learn" which MAC addresses can be reached on which physical ports. It is common for even the dumbest Ethernet switch to have a MAC table holding 1,000 entries. Communication between two devices that are connected to the switch module does not go through the Orbi router unless the switch knows, "THAT MAC address is out the port to the router".  My tests of Blocking were technically correct, but misleading.  The Orbi cannot prevent a wired device from communicating on the wired subnet because it never "sees" the packets.

A more correct experiment is to block a wired device and see if what happens to communications that leave the switch module.

Verified this by blocking a desktop computer that is also 'wired' directly to the router.

• It happily pings other devices that are wired to the router Ethernet module (or to a switch that is wired to the module because they both learn which port leads to specific MAC addresses).
• Other wired devices can ping it.
• BUT.. anything that has to pass through the router fails:
  • Trying to ping a WiFi device fails.
  • Trying to ping the desktop from a WiFi device fails.

None of my satellites have anything with a keyboard attached to them.  My guess is that devices 'wired' to satellites will also not be able to communicate to/from a wired device that is 'Blocked'.  The satellites each have Ethernet switch modules which learn MAC addresses, but they are separate switches.  They will say, "I know that MAC.  Use the router connection to reach it."

So, I am moreconfident that terminology is the root of the problem.  We humans want "Blocked" to mean "Do not let this thing connect to the network.  Don't give it an IP address.", whereas Netgear means, "This thing can connect (because it can be plugged in or because it knows the WiFi SSID/password), but nothing involving this device will get through the router.

If a device is Blocked in Access Control, then for all practical purposes it is completely isolated.  It cannot reach the internet. The internet cannot reach it.  The only thing it can do is interact with other devices that are wired to the same Orbi unit switch module.  How does it take orders from its Evil Master?  How does it report sensitive information?

[ron111157]

@CrimpOn

So, I am moreconfident that terminology is the root of the problem.  We humans want "Blocked" to mean "Do not let this thing connect to the network.  Don't give it an IP address.", whereas Netgear means, "This thing can connect (because it can be plugged in or because it knows the WiFi SSID/password), but nothing involving this device will get through the router.

If a device is Blocked in Access Control, then for all practical purposes it is completely isolated.  It cannot reach the internet. The internet cannot reach it.  The only thing it can do is interact with other devices that are wired to the same Orbi unit switch module.  How does it take orders from its Evil Master?  How does it report sensitive information?

That gives some measure of comfort. It stays within the LAN

[CrimpOn]

---

@ron111157 wrote:

That gives some measure of comfort. It stays within the LAN

---

Within the Ethernet switch module and any switches connected directly to it.  The LAN includes everything behind the router: satellites, WiFi, etc.  For example, if a Blocked device was the only thing wired to a satellite, I am confident it could not communicate with anything.

For example, if Access Control is set to "Block all new devices from connecting" and someone sneaks into the garage and connects a laptop to the satellite that is in there, it will not be able to do anything.  (Notice how Netgear used incorrect terminology. "Connecting" rather than "Block all new devices from being able to do anything except on the Ethernet switch module - if they are connected with a cable.")