Some additional info: I turned on the Traffic Monitor in the Advanced section of the System Tools and I can see all my known devices and their upload/download values.

However, this unknown android device doesn't show up in the list of devices and yet just a few minutes ago I got a disconnect and then 13 minutes later another connect.

It's done this twice today in the last 12 hours since I turned on the notifications. I can't figure out what could be doing it as I know all the hardware that is powered on and connected to my network except this. Could this be the router itself?

Maybe some internal OS process that wakes up every now and again and then shuts down over and over? Anyone have any ideas how to log/track/monitor/diagnose all the technical details of what this is?

Thank you.

@Kevin_Z Thank you for replying Kevin. It does not show up in the DHCP client list. I don't see any way to view the ARP list or Binding list from the Advanced Tp-Link web admin pages. 

I admit I'm only intermediately knowledgeable regarding networking stuff as it's not my day job although I have had training in it many years ago.

I don't want to change the network name or the password on the wireless network as this router is replacing a different brand router and I didn't want to have the hassle of re-entering all the passwords for all my devices again.

But on a reboot of the AX6000 this unknown device did send me a notification it connected.

In the System Log I see "ARP Binding disabled" so that's some default setting as I have not touched anything to do with this.

I wish it would give me an IP and/or MAC address when it re-connected, but I only get the email or push notification from the Tether app with the device's supplied name (I'm guessing).

@Kevin_Z Thank you Kevin. I see the ARP list in that security page. However, I do not see this unknown device there.

The connection pattern for this device is very strange. Here's the list of emails and the timing I've received so far today:

Date/Time                                        Event

-------------                                         --------

Mon., Dec. 7 at 9:12 p.m. CST        Connected

Mon., Dec. 7 at 10:01 p.m. CST      Disconnected

Tue., Dec. 8 at 6:06 a.m. CST         Connected

Tue., Dec. 8 at 6:36 a.m. CST         Connected

Tue., Dec. 8 at 6:43 a.m. CST         Connected

Tue., Dec. 8 at 8:17 a.m. CST         Connected

Tue., Dec. 8 at 11:10 a.m. CST       Connected

So far I haven't seen it logged in the Traffic Monitor. I turned on the Traffic Monitor last night at about 8:00pm CST.

The only thing unusual in the Traffic Monitor that I can't account for with all my devices is this: 

IP Address: 192.168.0.200 with MAC Address: 00-00-00-00-00-00 that had 1.47 KB downstream and 0B upstream.

This happened only one time during the Mon. Dec 7 @ 9:00pm to 10:00pm CST hourly window (it's too late for me to show the minute intervals now).

The only idea I had is that maybe this is my FitBit Sense watch that does have a wi-fi connection that I set up a while ago but that is not really in use since it only works when sync'ing music for Pandora or Deezer (which I don't have) or updating the device with new apps (which I haven't done lately).

I will attempt to do some kind of action to force the FitBit to use the wi-fi and see if it logs anything.

Other than that, as you suggested I did just install WireShark (I have used it a couple of times in the past, a few years ago) so I'll see if I can monitor the packets on my network to see what this might be.

It's odd the unknown device keeps sending Connected alerts but rarely sends Disconnected alerts when I have both turned on.

Regards,

Andre

@Kevin_Z 

Hi Kevin. So, I found out what the android-65347a971fe7ee86 name connects to.

I did this by recording all the known devices with their IP address and their MAC address from the DHCP list and the Network Monitor.

Then I noticed that in the Tether app when you go to add a new Known Device Alert, the selection list shows the device name and the MAC address underneath.

Well, it turns out this odd android name has a MAC address that matches my Samsung Galaxy Tab S1 tablet (which is still running Android 6 as it won't update any more).

What's odd is the tablet keeps reverting back to the 2.4 GHz band even though I connect it to the 5GHz manually in the settings.

I am only 5 feet away from the router so both bands are as high as they can be, so why would the router and/or tablet keep wanting to switch back to the 2.4 GHz band?

The tablet didn't do this before with my previous router (different manufacturer but only 4 years old and a dual band AC2600 MU-MIMO capable unit).

I noticed that when it switches bands, I get both a disconnect and then a re-connect alert (and just now a second re-connect alert consecutively 3 minutes apart from the first connection alert after the band switch).

So at least I'm satisfied I know about all the devices connecting, but I don't like that the band is switching automatically even though I don't have the "Smart Connect" feature on the router turned on and I have separate SSIDs for both bands.

I have no idea what the 00-00-00-00-00-00 MAC address is all about as I have no range extenders or repeaters on my network. It's a cable modem from my ISP in bridge mode connected to the Archer and that's all.

The only small bit of info I could find out on Google was that this may be a broadcast type of message from the router itself looking for the actual MAC address of a device or something like that. 

I do notice that my Galaxy Note 10 phone running Android 10 gives out a new MAC address every time I change the router settings since it thinks it's a new network and the OS now generates a virtual MAC. I have 5 different MAC addresses for this phone listed in the Known Device Alerts list.

The router does not get the true physical hardware MAC address of my phone even though apparently there's a way for software to request the device provide the real hardware MAC if it is hiding it with a software generated version.