1. Disable any WiFi sharing system by your ISP. You may have to google this part. Example: https://www.howtogeek.com/184727/your-home-router-may-also-be-a-public-hotspot-dont-panic/
2. Change your SSID and password to knock out this device. This won't stop it from showing if it tries to connect but it won't connect.
While reviewing my Home Network Device List (AT&T U-verse), I noticed an extra device "unknown08952AFA6593". The device was marked as Active and connected via Wifi(802.11), but had no signal strength indication, frequency, or IP address. It's SSID is "?".
Reviewing the LAN IP address allocation page, I can see that the device's IP address is 192.168.1.75. The device status is always "DHCP RENEW".
I ran an NMap scan on the device, which had 3 open ports.
80(http), which nmap reported was SAGE EAS Digital Endec remote audio monitor/level meter.
5555, ZeroMQ ZMTP 2.0, with:
NMap also reported:
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.10
I tried accessing the http via browser, and then telnet. All request attempts gave the same 404 HTTP/1.1 response and immediate connection termination.
After pinging, scanning, and several failed HTTP requests, the device is no longer reachable, although the router still reports that the device is Active.
I've eliminated every other device that I know is connected to the wifi, but I'm still unable to figure out what this device is, or where it's located.
It was also inactive for several days between the first time I discovered it, and today when it suddenly became Active again.
Any help, suggestions, or knowledge would be greatly appreciated.