TP-Link connection showing on RBR760 new out of the box

[Koz1614]

Hi,

I'm experiencing an unusual issue and can't seem to get to the bottom of it. Last week, I purchased a brand-new Netgear Orbi RBR760 mesh system from Costco, still in its original packaging. During the setup process, I connected the Orbi router to a Netgear CM1150V modem using an Ethernet cable, and I was using an iPad to complete the setup through the Orbi app. After the setup was complete, I noticed something odd in the device list: there was a "TP-Link computer" connection listed among the offline devices. This struck me as strange because I had a TP-Link Deco system set up the day before, but I returned it due to performance issues.

To investigate, I decided to return the Orbi system to Costco and exchanged it for a new one. Today, when I set up the new unit, I was surprised to find not one but two "TP-Link computers" listed in the offline device section. These devices have MAC addresses, but they lack IP addresses, and they're identified as wired connections. I'm thoroughly confused about where these connections could be coming from. I'm certain that no TP-Link devices were connected to the Orbi during the setup process.

My primary concern is not so much a security threat, but rather the curiosity and bewilderment surrounding these mysterious connections. Could this be residual data left on the Orbi from factory testing? Alternatively, is it possible that my modem somehow retained data related to my old TP-Link Deco system, even though I returned it? I'd appreciate any insights or suggestions on this matter. Thanks in advance for your assistance!

[CrimpOn]

What a delightful puzzle.  There is no way the Orbi router should be aware of any devices that had previously been connected to the cable modem.  The cable modem itself has a web interface (see the user manual).  It would be fun to see if the cable modem 'remembers' previous routers that have been connected in the past.

I would delete the unconnected devices and see if they come  back.

[Koz1614]

Thanks for the reply. I looked on the CM1150v modem and can't find any information related to previous devices. I also checked the logs on the Orbi and the two TP-Link devices were never assigned IP addresses (only the mac address shows). 

TP-Link

00:5F:67:0A:F6:E1

Wired

TP-Link	50:3E:AA:08:23:CE	Wired

[CrimpOn]

Was this a fresh install of the  Orbi 'app'?

i.e. it had never been used to manage an Orbi system before?

I am totally gobsmacked with this. On the one hand, it would be delicious to learn that Netgear connects TP-Link devices to Costco bound systems before they leave the factory.

Since this system is brand new, how much effort will be lost if the router is Factory Reset?

(In my case, a Factory Reset leads to over two hours of tedious data entry to perform all the customization that has gone on over the past years.)

[Koz1614]

I wanted to wait until I had more information to respond. I tried a couple things. I did the factory reset and upon second setup the tp-link devices did not appear. I also bought a new orbi system from Costco and reset my modem to factory defaults prior to setup. Upon completing installation - same thing - two additional devices showed up with a different name/different mac address. If you trace the mac address, they lead back to TP-Link...I think this has to be from the factory?

I am really confused at this point. I actually don't know if it is a security issue.

[CrimpOn]

My vote is for the factory.  I have never seen anything that describes the process Netgear uses to:

• Create credentials for a new package (SSID/password)
• Print out a label with these credentials, the router product number, and serial number
• Write the credentials into read only memory so that they will survive a power cycle and a Factory Reset.

Do they use:

• A WiFi connection?
• An Ethernet connection?
• A connection to the serial pins on the motherboard (before screwing the case together)?

Simply have no idea how they do it.

There could be a brief time during which the router is powered up with some default SSID/password that is used during the process and there happen to be some TP-Link devices which get connected during that interval?  Or, maybe it has no WiFi SSID and there are some TP-Link devices connected to whatever LAN is used to configure products?

(For sure, Netgear Orbi's are manufactured and packaged in China, where TP-Link is a major supplier of IT equipment.)

There is zero chance that this issue would make it through the Netgear 90 day support structure to someone who knows things (and cares).

I would delete those devices and move on.

[SLK-Purdue]

I can confirm it is from the factory and the "factory reset" doesn't really clear everything.  I can't get into a lot of detail about why and how I know this but Netgear is aware of this behavior.  It is a bug, in my opinion, but I also can't create a scenario where this causes any problem or security risk other than confusion and a mistrust of the data you see from your router.

Scott

[Koz1614]

Thanks so I take it you’ve seen this before on your own devices? Can you offer as to whether it’s part of the Netgear testing process before sending out devices to the consumer? Thanks again!

[SLK-Purdue]

Yes, I have seen this on my own devices and others that I work with.  I don't have any insight into the Netgear testing process but this behavior seems fairly common.

Scott