Curiosity About 2 Routers In IP Scanner Results

Joined
Dec 5, 2008
Messages
713
Reaction score
43
Points
28
Location
Detroit
Your Mac's Specs
2007 Mac Book Pro 2.2 Ghz 4 GB RAM SSD OSX 10.11 & 2006 MBP Stuck At 10.6.8
Hi Everyone!
Our network connection has been very slow for a few days, so I thought I'd try to figure out why on my own, hoping I'd stumble upon something I understood & could correct. (Yeah, sure!)

When I gave up and called the ISP (Wowway Cable), it was suggested I use an IP scanner application to check for unknown devices using our router.

A few years ago we had a speed problem with the ISP we had at the time (AT&T). They found that our neighbors hacked into our router. (So much for stealth mode) The ISP gave us a new router that was capable of better security. The new one uses WPA WPA2-PSK PERSONAL. Since there are the same people (government-employed computer networking professionals) next door, I wondered if we were slow again due to their attaching to us.

I opened IP Scanner by 10base-t Interactive and saw two items identified as routers. One router shows our ip address of 192.168.0.1 & one is 192.168.0.252. Both are identified as Arris, which is the brand of our router. The one ending in 252 has a mac address quite different than the one we know is our router.

I don't think the neighbors are back in our router, so I wonder what the second ip address is. The ISP didn't know what the mystery address is or what I could do to find out (or why our speed is suddenly slow). But for fifty dollars they will send a technician....

Thinking it be that the second ip address is because our router has both 3G and 5G, I checked "System Preferences-Networking" and looked at the ip addresses for 3G & 5G. The 5G is almost the same as the 3G, shown in IP Scanner, except the last digit is 5 instead of 1. I can't find the mystery ip anywhere in the Networking section of System Preferences.

We don't have any wireless repeaters or cable boxes, so that's out. No smart thermostats or refrigerators or tv's & stuff. Both of our cell phones were off.

Trying to enter the mystery address in the browser's URL bar showed a page that tries to load, but eventually times out.
I logged into our router, but can't find the ip addresses. I looked all over the About This Mac details pages. I found nothing that is a clue, so I'm all about useless at figuring this out on my own.

Do any of you all know what the source of this second ip address could be? And, should I give it a second thought or just ignore it?

Thanks For Helping!
Paul
 
Joined
Jan 1, 2009
Messages
15,452
Reaction score
3,808
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 15 Pro, plus ATVs, AWatch, MacMinis (multiple)
Well, that's sure interesting. Any IP with 192.168 as the first numbers is assigned BY the router to a device that is attached to it. I'd say you have someone camped on your router on that IP. I would change your password on the router to something really, really, really hard and try to get rid of the piggybacker. You will have to go to each device you want to have attached and enter the password again, but that's a small price for getting control back. And I would also make it a habit to check what's connected periodically. Living next to government-employed computer networking professionals is going to be a challenge for you and you will have to be diligent about security.
 
OP
PGB1
Joined
Dec 5, 2008
Messages
713
Reaction score
43
Points
28
Location
Detroit
Your Mac's Specs
2007 Mac Book Pro 2.2 Ghz 4 GB RAM SSD OSX 10.11 & 2006 MBP Stuck At 10.6.8
Thanks Jake for taking time to reply & explain.
I went with your suggestion & changed the password. Then I unplugged the router & took the battery out for a few minutes. Next, I re-connected only my computer.

I'll be darned! The mystery ip address was still there. I'm stumped. Is it possible that my router uses two ip addresses?
 
Joined
Jan 1, 2009
Messages
15,452
Reaction score
3,808
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 15 Pro, plus ATVs, AWatch, MacMinis (multiple)
Possibly. Tell us what router it is and maybe we can work it out.
 
Joined
May 21, 2012
Messages
10,702
Reaction score
1,158
Points
113
Location
Rhode Island
Your Mac's Specs
M1 Mac Studio, 11" iPad Pro 3rdGen, iPhone 13 ProMax, Watch S7, 2018 15" MBP, AirPods Pro
The router I get from my internet provider (Verizon FiOS) broadcasts three networks, 2-2.4GHz networks, 1 private and 1 public, then a 5.0GHz also. Of course, there is the option to shut them off. I leave them on and they are all password locked. You would need to login to your router setup to access these options.

Do you have a wireless printer on your network?
 
OP
PGB1
Joined
Dec 5, 2008
Messages
713
Reaction score
43
Points
28
Location
Detroit
Your Mac's Specs
2007 Mac Book Pro 2.2 Ghz 4 GB RAM SSD OSX 10.11 & 2006 MBP Stuck At 10.6.8
Hi All!
The router is Arris Model TG2472

This router also more than one broadcast choice. One is 2.4 Ghz & one is 5 Ghz (I made a mistake in my original post calling them "3G" & "5G") They are both on usually.
After reading your post, Bob, I turned 2.4 Ghz off & let the router reboot. The mystery ip address still showed up in IP Scanner application. Next, I repeated by turning on 3Ghz & turning off 5 Ghz instead. The mystery address is there again.

Our printer can be wireless by WiFi, but I have that turned off since neither Brother tech support nor I could get it to connect to the network. The printer is plugged into the router with an ethernet cord (I think that's what it's called. It is a cord with a RJ-45 connector). The printer shows up in IP Scanner as "Brother MFC Printer" and gives an ip address. If I unplug the ethernet cord, IP Scanner results no longer show the printer.

I made an error in my original post that we don't have many WiFi capable devices. I really should start paying better attention around here. We have a bunch-o-stuff:
One TV (rarely on), 2 cell phones, (never on at home) one iPad (often on) , two MacBook Pros (one's often on) & a printer (WiFi is off on the printer) & one treadmill (WiFi is off on the treadmill).

Next I turned the items on one-by-one & checked for new entries in IP Scanner. Then, I sent Safari to http://hwaddress.com and typed in, one by one, all of the MAC addresses showing in IP Scanner.
The results showed that each device's MAC address was associated with the actual manufacturer (except for the treadmill, which showed up as 'home automation device').

And, as usual, the mystery address was still on the list. it is identified as an Arris device by hwaddress.com

I sure am stumped!
 
Last edited:

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
Paul:

Do you by chance have another router that you can temporarily hook up and use it to test if that other IP address is still present? Normally, I would have thought that the Arris was spewing out two IP addresses at the same time, however since you came across two MAC addresses, I don't believe that's true.

I'm wondering if your crafty neighbors have somehow bridged across your router which would explain the two different MAC addresses. That's why you need to test with another router if possible.

Let us know.
 
Joined
Jul 24, 2013
Messages
5,073
Reaction score
758
Points
113
Location
Ohio (USA)
Your Mac's Specs
2023-14" M3max MBPro, 64GB/1TB, iPhone 15 Pro, Watch Ultra
I just took a look at the users manual of your router. It offers Parental Controls which means you can list the MAC address of the questionable device and you might have to get creative but you can block it from accessing websites. It doesn't have the features a lot of routers have which is to totally block a MAC address but you might be able to set times of no access or block enough sites to become annoying if it is your neighbor piggy backing off of you.

Lisa
 
OP
PGB1
Joined
Dec 5, 2008
Messages
713
Reaction score
43
Points
28
Location
Detroit
Your Mac's Specs
2007 Mac Book Pro 2.2 Ghz 4 GB RAM SSD OSX 10.11 & 2006 MBP Stuck At 10.6.8
Thanks Chscag & Lisa for helping out!

I borrowed a couple of cable routers from a friend's stockpile yesterday, but apparently my ISP is quite specific about which routers will work so I couldn't get the borrowed routers to connect to the ISP. The IPS has published a reasonably long list of compatible devices, but I couldn't come up with any of their devices to try.

Thanks for the idea of blocking. I set up the parental controls, telling it to trust only my computer's address. The filter I used was the keywords com, net, org, gov, a, e. i, o, u & y, guessing that one of those words or letters would be in many url addresses. Then I rebooted the computers & modem. The mystery address still appears in the IP Scanner results. The downside is that this router only allows us to trust 2 devices, so the filtering applies to all of our other items. I may have to turn off the controls again.

My next test was to change my password again. This time I did it at 4:00am when I was up, but their house was dark. I made a crazy password out of numbers, letters & symbols. Immediately after the router saved the change, IP Scanner still showed the mystery IP address. Unless the crafty neighbors have a fast password cracking program, I'm starting to wonder if they have anything to do with the mystery address.

I have studied a lot in the last few days, so I have a dangerous level of knowledge. (Little knowledge is dangerous...) I guess I'm mostly puzzled about why the mystery address' MAC address is reported to be a device by Arris, the same as the router manufacturer. But, finding out what physical device that MAC address belongs to is way out of my league. IP Scanner says it is a modem, but whose & where is it?

Just to test my patience, I called the ISP back & the tech support person didn't know what an ip or a MAC address was. I pestered my up the chain to the next person. His answer was "it's probably something on our end. It's OK". (His word "probably" does not inspire confidence in the "It's OK" statement.)
Next level person said "I'm not sure." and that was all I got out of that guy. Oy Vey!

Calling Arris didn't get me to a tech person. (I kind of figured it wouldn't)

At this point, I'm still stuck. I might have to take a trip to the cable company's customer center, router in hand, and have them check it out and explain the mystery address.
I don't know if that will do any good, or if I'll only encounter clerks, but it may be worth a try.

Thanks Again Guys! If you think of anything else I should try, please let me know and I'll be happy to test things out. It's fun to learn new stuff!

Enjoy This Day,
Paul
 
OP
PGB1
Joined
Dec 5, 2008
Messages
713
Reaction score
43
Points
28
Location
Detroit
Your Mac's Specs
2007 Mac Book Pro 2.2 Ghz 4 GB RAM SSD OSX 10.11 & 2006 MBP Stuck At 10.6.8
An Update...
For some reason I decided to try calling the ISP again. This time I was able to work my way up to someone who inspired confidence.
She examined the system and connected devices and agrees with you guys that someone is connected to our router. She also said it is a Belkin or Lynksys device.
The person explained that some routers have separate router & modem components & use two ip addresses to talk to each other. This router does not have separate router and modem inside, so it will have only one ip address.

She checked our firewall settings and said they are working & set up properly.

Her advice was to change the password & reboot. But she gave me a different method to reboot than I used. She told me to push the 'reset' button as opposed to unplugging it & takin gout the battery. He conclusion was that the mystery address would be gone until the squatter figured out the new password.

Unfortunately, the mystery address was immediately back on the list. I tried this routine 3 times with the same results.
Trying it with the router blocking the broadcasting the SSID name still resulted in the mystery address appearing. (I was told by the guy from the cable company who set up our system never to block SSID broadcasting because it invites attacks, so we normally don't have it blocked.)

I also thought of putting a router ahead of our existing router as kind of a lock-beofre-the-lock, but the ISP person said it won't work on their system to put anything ahead of their router, but after is sometimes OK.

My Next Idea...
I was wondering if I could block a certain ip or MAC address in the router. I found a page that is titled "Client IPv4 Configuration" and it says "The Router can be configured to restrict access to the Internet, e-mail or other network services." (Screen shot is attached)
I couldn't find a page to block by MAC address.

If I understand what the page says, adding an ip address means that the mystery device can not use the router for internet. But, can it still use the router to try to look into our devices? (OS X & iOS firewalls are set up on our items.)
Do you guys think it would help if I inserted the mystery ip address into that page?

Thanks!
Paul

IPv4 Filters Page.jpg
 
Joined
Jul 24, 2013
Messages
5,073
Reaction score
758
Points
113
Location
Ohio (USA)
Your Mac's Specs
2023-14" M3max MBPro, 64GB/1TB, iPhone 15 Pro, Watch Ultra
You can try blocking the IP address but that is an easy thing to work around - they can just change the IP address of their device. But give it a try just to see what happens. I would also make a long complicated password - that you will write down - to make it harder to find out.

To prevent any access to your computers, I would have sharing shut off on all your computers. You may have to have sharing for your printer but that is not a problem. Also under Settings -> Privacy and Security -> turn on the firewall.

Lisa
 
OP
PGB1
Joined
Dec 5, 2008
Messages
713
Reaction score
43
Points
28
Location
Detroit
Your Mac's Specs
2007 Mac Book Pro 2.2 Ghz 4 GB RAM SSD OSX 10.11 & 2006 MBP Stuck At 10.6.8
Thank You Lisa for the good advice- especially about the long password & firewalls.

We keep the router's firewall on, as well as the ones from OS X & iOS. I rarely put my phone on the WiFi & my wife never has used hers on WiFi. (We don't have data plans, so once in a while I go on line with the phone to get an app or something.)

We don't have Sharing set up on any of our devices. Sharing is off in System Preferences on the OS X machines.
I don't know why we can print to the printer from our MacBook computers with sharing off. I can only make a very uneducated guess it is because it's plugged into the router with an ethernet cord. We've never tried printing from the iPad or phones.

Here Are This Afternoon's Adventures-
The first thing I did was to change the router's passwords for 2.4 Ghz & 5 Ghz, as well as the password to access the router's settings.
For the 2.4 & 5 Ghz passwords, I went to a 42 character entry with lots of numerals & special characters. Then I reset the router.
I signed my computer back into the network with the new password. I did not tell any of our other devices the new password.
Now, with the new password, I was positive my computer is the only item using it...
I was wrong. The mystery IP address was still on IP Scanner's list.
The printer was on it too, but maybe because it's plugged directly into an ethernet jack. So I unplugged it & started over. Mystery address was still present.

Next-
I blocked the mystery ip address in the router's firewall setting for filtering IPV4 TCP & tried to block it as UDP but the router didn't allow it.
After blocking it in TCP and rebooting the router, the mystery IP address was still in the IP Scanner list.
I wondered if the router itself was using that ip address and by blocking it, the router may not access the internet. I was wrong again. Everything worked fine. (But, of course, the address still showed up on the scanner list, so it may have never really gotten blocked.)

Next-
I downloaded two more IP scanning tool applications & tried them. They each showed the mystery address, thus confirming that IP Scanner app wasn't giving false data.
All 3 IP Scan programs show the mystery address is from Arris Group. I don't know how accurate that designation is, especially since the ISP tech person told me this morning it belonged to a Belkin or Linksys device. (I went back to a web page that checked the MAC address for me yesterday & it still said Arris.)

So now I m even more confused. (But learning a lot & I appreciate all that you each are teaching me along the way.)

Paul
 
Joined
Jul 24, 2013
Messages
5,073
Reaction score
758
Points
113
Location
Ohio (USA)
Your Mac's Specs
2023-14" M3max MBPro, 64GB/1TB, iPhone 15 Pro, Watch Ultra
I am beginning to wonder if for some strange reason your router is broadcasting two ip addresses. That would be beyond weird but I can't think of what could be going on.

Here are some things I would try just to explore:
Open Network Utility which you will find in the Utility folder of your applications.

Try running through some of the utilities especially Traceroute - put in the mysterious ip address and see what happens. If it returns any IP address that does not start with 192.168.0.X it would indicate the route to get to that IP address is going out on the net. Of course if your neighbor is tapped into your router it still might not show outside IP addresses.

Try Pinging the address to see if it responds. That way you will know if it is active.

Lookup and Whois will most likely give you nothing as the ip address is a local network address.

Port scan will tell you of any open ports on the router. Port 80 is normal as that is needed to access the internet. There are others that are okay too and if you have any you suspect you can google it to see why it would be open. If you still have questions ask and I will post back.

Netstat will give you a ton of information and can be very confusing but you can run it to see what it does.

I love this utility so much I leave it on my desktop. It is a great app for a starting point for troubleshooting.

This will give you more to check out!

Lisa
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
@Paul and Lisa:

My ISP just last Tuesday installed a new Arris Router in my home. We have a FIOS high speed connection and I'm not sure if the router is the same as Paul's. It (the router) provides 4 networks: 2.4Ghz, 5Ghz, and 2 Guest connections. It was a lot of fun getting all our devices to cooperate with the new router but finally everything is under control. My WiFi printer was especially fussy.

Anyway, I checked the IP address to see if maybe the Arris was behaving the same as Paul's. My router shows only one IP address and seems to be consistant with what Lisa stated when running Netstat from Utilities.

What I suggest for Paul to try if he has a spare router (I always keep a spare around) is to remove the Arris and hook up the other router temporally to see if the mystery IP address is present. I still suspect (only a guess on my part) that whoever is piggybacking on Paul's system is somehow providing a bridge across his router. Swapping routers for a test should give us an answer one way or another.
 
Joined
Jul 24, 2013
Messages
5,073
Reaction score
758
Points
113
Location
Ohio (USA)
Your Mac's Specs
2023-14" M3max MBPro, 64GB/1TB, iPhone 15 Pro, Watch Ultra
I had given thought to suggesting another router. It would be very interesting to see what was shown. I would predict at least initially it would be one ip address and if the neighbor is piggy backing then eventually another one would appear. But even that might not work if the provider assigns a static IP address to the OP's connection and if the router has the same IP address. The piggy backer might slide right in.

Lisa
 

Slydude

Well-known member
Staff member
Moderator
Joined
Nov 15, 2009
Messages
17,596
Reaction score
1,072
Points
113
Location
North Louisiana, USA
Your Mac's Specs
M1 MacMini 16 GB - Ventura, iPhone 14 Pro Max, 2015 iMac 16 GB Monterey
I admit to being absolutely stumped on this question. I was beginning to wonder if there was some sort of guest network that is on by default causing the problem. Charlie's experience with guest networks and the router generating a single IP address suggests that is not the issue though.

I also wondered if the scanning software was giving false readings but the fact that multiple utilities are generating those results suggests that is not the issue either,

Is it possible to shut down all wireless access temporarily to see if the second address remains? Perhaps that has been tried and I missed it.

Edit: the manual I found suggests that this device has some basic telephony capabilities. Could that be the reason for the second address?
 
Last edited:
Joined
Oct 1, 2007
Messages
7,163
Reaction score
275
Points
83
Location
UK
Your Mac's Specs
Mac Mini i5 (2014 High Sierra), iPhone X, Apple Watch, iPad Pro 12.9, AppleTV (4)
There have been exhaustive ideas here but I agree with SlyDude.

Turn off all wifi on the router then disconnect all ethernet cables apart from your laptop. If the 2nd address is still there we can discount any likelihood of an outside attacker (i.e. as it's an internal address range and your router is the DHCP server only it is issuing IP addresses. If the mystery IP is in the range is HAS to be attached to the router in some way).

I suspect this is an internal function of the router. Some routers issue themselves a second IP to seperate user admin and one for ISP/engineer. However, I would have expected your ISP to know this.

I'll have a futher look into the manual
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
I suspect this is an internal function of the router. Some routers issue themselves a second IP to seperate user admin and one for ISP/engineer. However, I would have expected your ISP to know this.

I agree, however, I have spoken with ISP support representitives who knew less about their equipment than I did. And if you mention you're using a Mac that immediately rings a bell in their head and they then blame it on your Mac.

I was fortunate this past week when my ISP installed a newer high speed router in my home. The technician who came to do the installation was also a Mac owner and explained everything to me in Mac terms. Got the new system going in record time. :)
 

Slydude

Well-known member
Staff member
Moderator
Joined
Nov 15, 2009
Messages
17,596
Reaction score
1,072
Points
113
Location
North Louisiana, USA
Your Mac's Specs
M1 MacMini 16 GB - Ventura, iPhone 14 Pro Max, 2015 iMac 16 GB Monterey
I agree, however, I have spoken with ISP support representitives who knew less about their equipment than I did. And if you mention you're using a Mac that immediately rings a bell in their head and they then blame it on your Mac.
I agree. I've experienced the same thing on several occasions.

I once had an IT person tell me that the reason a network I would have liked to access via Mac did not permit Mac access was that Macs generated a lot of extraneous network traffic. Now before someone says that might be true for AppleTalk traffic I'd like to point out two things:
1. This was long after most Macs were using TCP/IP to handle traffic. About the only people still using AppleTalk were folks that had one of the Apple laser printers that just refused to die.
2. At no point had I indicated any need for / desire to use AppleTalk.
 
Joined
Jan 1, 2009
Messages
15,452
Reaction score
3,808
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 15 Pro, plus ATVs, AWatch, MacMinis (multiple)
Not to make any suggestions, but maybe to trigger thoughts: What Paul is looking at are the IPs that have been ASSIGNED by the DHCP server in the router to devices it sees. The wifi ones use the password to control who gets an IP address, so his changes to that function have worked for wifi, but passwords are not used for directly connected devices. I think the rationale is that if a cable is plugged into the router, the person who owns the router knows and trusts the other end of the cable. Hence, the printer appears even after the password is changed because the password is for WiFi, not cables. So, Paul, are there any other cables plugged into the router? Bear in mind that what you probably have is a combination modem/router, so the cable company line (usually coaxial cable) is connected that is the feed from outside the home and goes to the modem portion of the Arris. Internal to the modem/router, the modem part connects to the cable system, receiving and transmitting signals on their system. The WiFi part is then broadcasting the wireless portion of the network and the LAN ports on the back, where the printer is attached, allows direct connections to the router portion of the device. Your modem is assigned an IP from the ISP, but your internal LAN is controlled by the DHCP server in the router. So, the numbers in the range 192.169.x.x are assigned by the router to the devices it sees either directly attached with cables or that get in through the WiFi receiver. The IPs are NOT being broadcast, but generated in response to some device that has requested an IP from the DHCP server in the router.

OK, so with that explanation out of the way, this extra device that is showing up is asking for, and being given, an IP from your router. The fact that it is showing as an Arris to you, but as something else (Belkin or Linksys) to your ISP is curious. Given that you have basically closed your system with a very strong password over WiFi but this IP is still assigned seems to me to indicate that perhaps you have another device hard-wired to the router, or that the port is being asked for by something inside the modem/router itself. Hence my question. If you look at the back of the router there should be two cables attached: the coaxial from the ISP and the ethernet to the printer. Is there anything else?
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top