Massive amount of unknown Devices tried to connect to Homehub modem

[KK]

I was looking through the "My Devices" section of the Homehub modem when I started notice an alarming amount (60+) of unknown devices that have tried to connect (some have according to the usage statistics). All in the past couple of months (2-3). (60+ unknowns every months it seems)

Is this just random people trying to use my wifi unsuccessfully ? (though according to the usage statistics, some connections did transmit data (varying fractional amounts).

The modem is secured with WPA2 and the password is quite strong so I don't understand what's happening here.

Has anyone else encountered this ?

[ZaneP]

Hi @KK 

"My Devices" shows LAN devices that are currently connected, or were connected. It doesn't display attempted connections. So I'm not sure what you're referring to. Please let us know what modem dashboard screen you're looking at. Could you post a screenshot (with private info covered up)?

If you look at the System log in "Advanced Tools and settings" you'll see when connects were attempted (and failed to connect).

That log entry looks like this:

2023-09-07 18:00:16

ERR

WIFI

A device <device mac address> failed to connect to SSID (your wifi SSID) because it provided incorrect login information.

If your password is strong, attempted logins will fail.

Hope this helps.

Cheers,

ZaneP

[Vanadiel]

There should be a "hide" and "show" button.

The show mode shows all currently connected devices.

The hide mode shows all devices ever connected. In hide mode you will see a "forget" button behind each hidden device to remove the device from the list and forget it ever connected or tried to connect.

Wifi and LAN each have a separate list. If it's the Wifi list it can be from other phones and cars trying to connect to wifi networks in range, including yours.

Nothing to be concerned about with WPA2 and a strong password.

[ZaneP]

It seems to me that for @KK , the bigger issue is attempted connections to the LAN (via the gateway modem). The system log will show what device (MAC address) attempted to connect, and on what date and time. A successful login will show up in My devices on the Wifi or Ethernet list. My Usage can be customized (by date) to see if any of these devices @KK noted generated any traffic on any specific day or period.

Modems are constantly being probed, and reported by the firewall. I see these attempts in my system log daily.

As we both wrote, a strong password is vital. WPA-2 is Bell's recommended security certification and hopefully every customer has implemented it. 

[KK]

Hi, thank you for the reply.

I have attached photos.

Here is the "My Devices" section of the dashboard which shows devices that "were" connected. Although there is no date associated with them, I have checked this list in the past and there have never been this many devices ever connected to our network (at most there are 10 in total and even including friends/guests and family there wouldn't have been more than 20). The screenshots only show the beginning of the "list" as there are too many to upload (there are as I've said 60+ that have connected according to this list):

Here is the "My Usage" list which shows another set of abnormally high connections made in a very recent time-frame. There was no one that I'm aware of making these connections. Again this is just a portion of the list I compiled:

I'm not sure what to make of this. It seems alarming.

[KK · Accepted solution]

I think I might have figured out what's happening, although I'm not sure.

One of the security features on my phone has the option to "randomize the mac address" with every new connection made via wifi. I believe this is what I'm seeing as it's not reasonable to assume WPA2 has been bypassed,

I feel a bit silly but I think this might be what I'm seeing.

Anyways thanks for the responses.

[Vanadiel · Accepted solution]

That would be plausible. I would keep monitoring. Now that you have randomize MAC turned off, the connection attempts should disappear. I would clear the log to get the best possible overview.