Unknown IP address reconnects to router after blocking

[Anonymous]

I have a device connecting to my router. IP address is always 165.165.165.165, but after I block the device, it comes back with the same IP address and a different MAC address. Any idea of what this is?

I was looking into devices because I've been blowing through my data at an alarming rate and was able to identify all other devices.

[Anonymous]

That IP is supposedly in South Africa. But if it shows a MAC address it sounds like it is an internal connection. Which network is it coming from, inside or outside? What IP and port are they connecting to? You should turn off external management if you have it enabled.

[Anonymous]

Connecting how? To your wireless network? Change the WiFi password.

[Anonymous]

Anonymous wrote:Connecting how? To your wireless network? Change the WiFi password.

Not likely to be wifi with that IP. I’m wondering if it’s actually an outbound connection and OP thinks it’s inbound.

[Anonymous]

Anonymous wrote:

Anonymous wrote:Connecting how? To your wireless network? Change the WiFi password.

Not likely to be wifi with that IP. I’m wondering if it’s actually an outbound connection and OP thinks it’s inbound.

That doesn't explain the changing MAC address. That should be the next hop router and that won't change unless you restart your router. I don't know of anything that let's you review connections on most routers. That's more an IDS/IPS thing which is typically only on hosts or specialty software/hardware.

[Anonymous]

Anonymous wrote:

Anonymous wrote:

Anonymous wrote:Connecting how? To your wireless network? Change the WiFi password.

Not likely to be wifi with that IP. I’m wondering if it’s actually an outbound connection and OP thinks it’s inbound.

That doesn't explain the changing MAC address. That should be the next hop router and that won't change unless you restart your router. I don't know of anything that let's you review connections on most routers. That's more an IDS/IPS thing which is typically only on hosts or specialty software/hardware.

You can certainly see connections on business grade routers, less so on Harry homeowner routers. I have seen some with connection tables though, especially if they have firewalls built in. Not sure what to make of the MAC address. Why would he have a local connection with that IP? It’s not going to get it from his dhcp server.

[Anonymous]

Post some of the MAC addresses so we can see if they all have the same manufacturer prefix. If so that might help identify it. If not, there's not much else you can do.

The simplest fix is to change your wifi password so it can't join your network.

[Anonymous]

I found the same IP address attached to my network. I blocked it and it reappeared on my 5G network. I blocked it again and it has yet to reappear.
South African. Telkom SA Ltd.