TP-Link owned MAC address shows up as wired client with no IP?
I've been noticing this TP-Link owned MAC address as a wired client for a while (across controller updates) and am wondering what it is?
The address is: 54-AF-97-70-D5-BA
The client list sometimes shows it as connected to port 1 and sometimes port 4 of one of the switches. In the first screenshot it says port 1. In the second screenshot of the map it shows as port 4, and is currently also shows as port 4 in the client list (it dropped and re-showed up in between screenshots).
Both ports 1 and port 4 are wired directly via single ethernet cable to EAPs with no devices (e.g. no switches) in between.
You can see it show up in wired clients here - it seems to never request an IP address, and sends/receives very little (but some) traffic. It will also frequently dropp off the network and show back up as a wired client at a later time:
Devices like this make me trust the topology and client detection even less than I already do - how should I debug further what this is and why it pops in and out of the client list?
@Vincent-TP Thanks for the suggestion to check the logs, I hadn't been looking at event logs and they are helpful - it's odd how this mac address (that shows as from TP Link's allocation: https://macaddress.io/mac-address-lookup/x5DXywn056) bounces around appearing as if connected to either one of two EAPs (A 772 and a 683-LR) or wired via the SG2210MP that both of these EAPs are connected to upstream):
I don't (currently) have any wall EAPs deployed and these two EAPs are directly wired with solid connections to the upstream switch. I guess I will try rebooting next, but will have to wait for a time nobody will yell about (both are PoE via the switch, so cycling that switch should restart everything).
Does TP-Link have a way to do more granular MAC address lookup to see what type of device this address is likely to be coming from?
@daubstep, Over the last few years of using this system, I've noticed similar behavior. Do you have your EAP's configured for mesh capability? Each EAP has multiple MACs due to the different BSSID's they can have and use for failover and connecting to each otherl. It drove me nuts for almost a week, until I started seeing in the logs and digging around in the that the mac-addresses were technically being used when I had two or more access points as part of a bridge/mesh.
If you go to "Device List" and then select "APs" to narrow down your devices. Make sure you have the view of the "BSSID" column by selecting it from the elipses in the upper right hand corner which lets you modifiy what columns are visible you will see the BSSID associated with each access point. If you hover over the BSSID column for a specific access point you will see multiples, depending on the amount of radios your AP has. From there, I manually made DHCP entries so that when I saw those MACs in the future I knew it was one of the BSSID's and not some rogue device. See the screenshot below which will hopefully clear up what I'm saying.
I do wish as part of the mesh system I could pick and choose which AP's I could include in the mesh network, as I use some AP's for infrastructure (bridges), and others just for users access.
Hope this helps.
Cheers!