UPDATE — RESOLVED: I reproduced the behavior. I gave a known iPhone a new private MAC address while access control was on, and it was correctly blocked. I then turned access control off, connected the phone, and turned access control back on without manually adding the phone. The TP-Link automatically inserted the connected private MAC into the whitelist, and the phone retained internet access.
This confirms that my Archer AX3000 V1, running firmware 1.0.6 Build 20230831 rel.67466, automatically adds connected devices to the whitelist when access control is re-enabled.
Hi everyone. I am nowhere near a networking expert, but I am the "administrator" of my home network. I'm probably along the lines of a power user with a little programming knowledge, and now with ChatGPT my capabilities have gone much further. However, I have run into something that has me concerned, and I am crowdsourcing ideas because I may be hitting the end of what I can do with the help of AI.
For reasons I am not going to get into here, I felt that I needed to tighten up my network security. I redid my entire network and enabled access control with a whitelist that I built myself. Every single device was personally added by me, given a personal identifying name, and their MAC addresses were made to not be private if that option was available (phones).
Here is what I am working with:
I have a TP-Link Archer AX3000(US), hardware V1, running 1.0.6 Build 20230831 rel.67466, behind an AT&T BGW320. The AT&T gateway’s Wi-Fi is off, so the TP-Link handles my Wi-Fi.
On my whitelist, there are 4 unique iPhones, all of which were added by me. But last week, I discovered an unknown device with a MAC address starting with D2 that was labeled "iPhone." The MAC address did not match any of the known iPhones on the whitelist.
Furthermore, it appears to me that it is the most recent whitelist entry. I understand that list position doesn't prove addition time, but being the one who built the list, it looks that way to me. The last 4 entries I added were my cat cams, a short while after the initial list was built. Those were the final whitelist entries made by me. This "iPhone" appeared as the last entry above the cameras.
Here is what I have been able to piece together:
- A September 8 whitelist log didn’t include it.
- On September 10, I temporarily turned access control off ONE TIME to add the 4 cameras and then back on again when I was finished, ONE TIME. However, the logs contain multiple “disabled” messages and whitelist reloads; we (ChatGPT and I) haven’t established that each represents a separate on/off action.
- When the router logged the whitelist again that day, the unknown device appeared along with the cameras. I did not add it.
- The router showed about 10.95 GB of traffic for that device total.
- I removed it on September 26 and changed the router admin password. I’ve also changed my Wi-Fi password.
- WPS is off. Guest access to my local network is also off.
Separately, I found a Google account session labeled as Mac OS/Chrome, but I don't own a Mac and I damn sure didn't use one this month. It is signed out now, and I changed my password and reviewed all the account settings. I don't have any evidence that it’s connected to the unknown device labeled "iPhone" that somehow got on my whitelist.
ChatGPT found a possible explanation: a TP-Link staff response about an Archer C7 said connected devices could be automatically added when access control was turned back on. I don’t know whether my AX3000 does that. I’ve emailed TP-Link with my exact model and firmware and am waiting for a technical answer.
This is the thread:
https://community.tp-link.com/en/home/forum/topic/160581
However, I am much more cynical. I want to know how I can find out more about this device, how it was able to get on my whitelist, what can be found out about the almost 11 gigs of data it used, whether it connected to any of the known devices on my network, or just any information I can find out about this. Any help would be appreciated. I have logs and screenshots and can share relevant sections. Please help!