Hello,
I’ve noticed unknown devices with strange IP at my ARP List at eth1 interface which is connected to my ISP router. When I delete this weird IP they show up again and the number of them is constantly changing.
I have two pools, one is 10.0.0.x and another one is 10.0.1.x (for VPN) but this devices uses 10.200.x.x
What is this? Thank you
EDIT// I use Mikrotik hAP ac^2 with cAP ac
Check your WAN IP address, check gateway address, check DNS server address(es) defined by ISP. Try sone traceroute to see if ISP core network runs off similar addresses…
No, as far I checked I can’t find this type of IP.
Also in logs there is something like this:
As I don’t have any idea about your network topology I’ll assume default setup … if your layout is different, then enlighten us.
Default setup assumes that ether1 is used for WAN. If ISP is using PPOoE, then there would be PPPoE client running pinned to ether1. In this case no direct IP setup should be used on ether1 (i.e. no manual IP address nor DHCP client running).
From the latest screenshot it seems that those unknown IP addresses are beyond ether1 (in-interface) and your RB is kind-of routing it to some pppoe interface (because your public IP address is bound to that interface). The big question is: how comes router is accepting IP packets on ether1 when that interface should not bear any IP config at all?
There are many unknowns and it’s not possible to say why you’re seeing those IP addresses … without knowing RB config and without knowing what kind of service you’re getting from ISP.