cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Vast quantity of random MAC Addresses showing-up since last Firmware Update

Gelert5
Established Contributor
Established Contributor

Hi all - I'm hoping someone can advise me on what's now occuring, chez moi.

I have an SH32B, connected to FTTP.
The latest Firmware was installed on 25th June 2025.
r3.8.11-R-1414606-PROD-83002, with the GUI now at 2.36.9.

Since that FW update, the Technical Event Logs (viewable / downloadable from the SH32B via the PC Browser Webpage) are recording some rather alarming activity.
Between 2nd July and just now, there are circa 1000 'Device Xx:Xx:Xx:Xx:Xx:Xx connected over Wi-Fi'  Log Entries (= circa 175 per 24hr period), 99.5% of which are random MAC Addresses.
And each MAC Address with a 'Private IP Address' of 0.0.0.0 (as shown on the Home->Advanced settings->Advanced Wireless->Show Disconnected page).

Rebooting the SH32B has had no effect.
And I powered-off the three EE Wi-Fi Discs and also the EE Hybrid Connect Back-Up device we have, for 24hrs - all of which has had zero impact on this phenomena.

Some of these random MAC Address 'Log Entries' seem to appear only once.
But others are allegedly 'connected over Wi-Fi' multiple times in succession - the Log Entries seem to be at a sample rate of once-per-minute, with one MAC Address showing as having been connected nine times over a ten minute period.
To confirm, these MAC Addresses are nothing to do with any of the devices that we own and operate on our network(s).

Before I go all paranoid, is this perhaps something to do with my EE Wi-Fi now being 'loaned-out' by EE to other EE customers (as BT used to do), since the new Firmware was installed...?
In which case it would be nice to have been informed of this...

Or is this something more sinister?

Thanks in advance for any guidance / clarification / enlightenment that can be given,

Louis.

25 REPLIES 25
JimM11
Brilliant Contributor
Brilliant Contributor

@Gelert5 

My that's FREE party time speed's couple HD movies watched at that, better get the trouser leg rolled up, learn the funny handshake and keep a blindfold in the back pocket for getting carted away!

Should disappear after a day or so, but one to keep the eye on with the old FW you never know what happens and Factory Reset bet that brings it back but hopefully does disappear and respect EE's database account settings.

Need to go fined a BT/EE document must be a disclaimer somewhere Register or not opt out off using EE WiFi then you agree to having your router as a Hotspot for the masses!🤣👍

Gelert5
Established Contributor
Established Contributor

@JimM11

I've just looked at the Technical Log File this lunchtime.

Interesting that the SH32B's Ethernet Port #4 'Reset Itself' (Network interface eth4 down->Network interface eth4 up) five times last night at 0330-0333hrs.

And since then, no more 'alien' Log File Entries.

YAY!

Interestingly, I can still connect to EE WiFi with both my Tablet and my Mobile this morning.

So perhaps 'opting-out' doesn't remove one's access to the EE Open Network, but merely shuts-down the Hub's broadcast?

Early days...


@Gelert5 wrote:

a) If my single connection only raised one single 'Log Event' (despite that connection duration being about one hour), why are other singular MAC Addresses showing-up as multiple 'Connection Events', recorded every one minute or so?


I honestly wouldn't pay too much attention to the Technical Log. It's pretty bare-bones and is clearly ommitting a lot of information. As far as the number of Wi-Fi events is concerned, different Wi-Fi devices will exhibit different behaviours; some might frequently enter/exit low power states and that could be seen as repeated association/disassociation events, whereas others might only show a single connect/disconnect per 'session'.

b) The Log Events therefore cannot be used to ascertain 'duration of connection' in any way.

Agree, and I wouldn't suggest trying to use them for this purpose.

c) If someone were to connect to my EE Open Network and then carried-out 'nefarious activities', what possible defence could I offer GCHQ et al that 'it wasn't me, guv'...


As @XRaySpeX has mentioned, EE WiFi is completely isolated from the rest of your network and a customer connecting to it will be assigned an IP etc. from within the EE WiFi network, rather than your LAN. I think it would be pretty easy for EE to establish if something was or wasn't you, should they be approached by an authority. Remember, an EE Wi-Fi user also has to authenticate against a valid EE/BT account before they can access the public Internet i.e. they need to explicitly enter their EE/BT username and password before they're granted full access.

Intrigued to know whether or not those log entries subside after the opt-out has taken effect. I wonder if the older hubs (BT Smart Hub 2/EE Smart Hub) also log EE WiFi events 🤔

Gelert5
Established Contributor
Established Contributor

@XRaySpeX 

'Like the others does the tablet's MAC Address have a 'Private IP Address' of 0.0.0.0?'

Yes...

Gelert5
Established Contributor
Established Contributor

@bobpullen 
'Intrigued to know whether or not those log entries subside after the opt-out has taken effect.'

Yes - see above! 😎

JimM11
Brilliant Contributor
Brilliant Contributor

@bobpullen Just went and tried to get on the neighbours BT Smarthub2 EE WiFi, good thing was it looked like EE have shut down the account side for me correctly, connected but no Internet, will try the OTHER official EE Hotspot when out later in town, as a JIC, wifi signal was in the high -80's db and not exactly sure where the Router is located in his home!👍