Device HW Address IP4:xxx rather than MAC address

[LuPaMo]

I've had a few intermittent problems with this, whereby previously trusted devices (correctly identified by its MAC address) are showing as "New" devices. Upon further inspection, their HW address is no longer the MAC address but identified as "IP4:xxx.xxx.xxx.xxx" where the X's match the devices assigned IP address.

Any ideas on whats causing this?

[LuPaMo]

This the the "New" device with the incorrect HW address

[LuPaMo]

The original trusted device entry;

[sy]

Hi,

Could device have Randomize MAC activated? Can you create a filter with its MAC Address and check if it has any TCP or UDP session?

[LuPaMo]

Hi,

Ive checked the device settings and doesnt appear to have an option for random MAC.  In the OPNSense ARP table the IP + MAC address appear correct, as does the UniFi controller for the AP its connected to.

Filtering on the device, it has open sessions (which are blocked as its not a trusted device).

Cheers,
Luke

[LuPaMo]

To add, for the active session(s); its showing the device ID is the IP4:xx, but the HW address is correct

[sy]

Hi,

If you remove the untrusted one, does it come back?

[LuPaMo]

Hi,

Yep, comes back after a minute or so

[sy]

Hi,

Please share a report by following the instructions in the below link

https://www.zenarmor.com/docs/support/reporting-bug

[LuPaMo]

Done - thanks for your assistance on this

[sy]

Hi,

We have investigated the issue. Zenarmor engine has a logic to identify Router. It causes this issue. With 1.18, we will ship an improvement for this. This logic will be disabled in default to prevent this false positive status.