Unknown wireless client (Camera)

[Einstein]

We have an unknown wireless client roaming on our open SSID network. 

Meraki reports it as: CyberTAN Technology Axis communications ab IPCamera

Seeing as it is a camera, it has our eyebrows raised. I have asked staff, no new devices have been brought in. The device has moved, or "bounced" AP's a couple times. I do not want to shut it down until I know what it is. I can ping continuously. I can see the AP it is currently connected to, nothing around I can see. Any one ever come across this particular device?

Thank you in advance for any clues.

[Nash]

Google suggests those are usually security cameras. Anyone installed a new cam recently?

If no one knows what it is or who owns it, I'd block it and see who complains. Harsh but usually effective, especially when it's a mobile device.

[Einstein]

No. I have gone over this incident with all staff. I did a MAC lookup, and all that comes back is CyberTAN technologies. Very strange that it has moved AP's a couple times. Iphones, and Android phones always are identified correctly. We have a couple folks with USB cameras that sit on top of a monitor, but none that are wireless. No new hardware has been implemented that I know of. I am still pinging it, solid ping non stop. Packet capture is empty. Do not know if that is good or bad. the mystery continues.  I will go ahead and swat it down as you suggest. Will see if anyone complains. 

Thank you Nash for the quick reply, I appreciate it.

[BrechtSchamp]

Mac addresses can be spoofed. Maybe that's what is going on?

[Nash]

---

@BrechtSchamp wrote:

Mac addresses can be spoofed. Maybe that's what is going on?

---

Good point here. I'd continue to monitor your network for new and exciting unknowns.

[PhilipDAth]

Point your web browser at the IP address - what comes up?

[Einstein]

First thing I tried........."This page cannot be displayed".

One thing that I found. I can ping through Meraki portal, but CANNOT ping through cmd line on my network. 

I am fairly certain this is a misidentified, but I still do want to find out what, and where it is. 

Thank you all for the info, I appreciate it. 

The mystery continues. 

[PhilipDAth]

>First thing I tried........."This page cannot be displayed".

Is the SSID configured for bridging and did you try to access it from the LAN?

You wont be able to access it if you are using NAT mode or client isolation.

[Network-dad]

@Einstein  I would try what @PhilipDAth suggested point your browser at the IP address.. remember to be on the same network.. also this will only work if you are not using NAT and not using client or LAN isolation. 

[Einstein]

I just ran a network scanner from a different computer. It does pick it up as well. So even with a different computer, and a different scanner this device still shows up. I cannot get anything to come up when trying the IP address. Cannot obtain any additional info from the scan....no host name....etc.. I set laptop up for same subnet...etc. Something is definitely there, just cannot get any additional info. I do have it blocked from the internet. No one has yelled.  

[BrechtSchamp]

I think you can probably sleep on two ears with it blocked. But you could try nmap to see if that gives you more info.

[Einstein · Accepted solution]

After MUCH!!! Investigation it turned out to be a smart TV. This TV has been hanging for a couple months now with no issues. We actually have at least 10 of these smart TV's scattered throughout our building.  I had the wireless turned off, but somehow it turned itself back on, (or someone was playing), then did a firmware update which in turn cascaded into it being identified on the network as an Axis wireless camera. Apparently some of these smart TV's have a motion type sensor built into them which can sense hand motion...ie change channel...etc. I believe this may have been at the root of this. I have read several other articles mirroring what I have experienced. 

Consider this case closed, again I appreciate all the help from everyone. This is the first time I have reached out to the community, I was pleasantly surprised.  

[BrechtSchamp]

Nice! Thanks for reporting back. Glad we could make it a pleasant experience!