Every network card in the world carries a maker's number in the first half of its address, and the list of who owns which is public. Mine belongs to a firm that was wound up before wifi existed.
I run the wifi on a campsite. Two hundred pitches, eleven access points on poles, a controller in the office, and it is the single thing people complain about more than the showers.
The part that matters here is the thing nobody thinks about.
Before a device gets an address, before a password, before any of it, it announces its MAC address: six bytes burned into the network card at the factory. The first three bytes are the manufacturer, and that allocation is public. Anybody can look up who owns a given prefix, because the registry is published.
My controller logs every association: time, access point, MAC, signal strength, and whether the password was accepted.
I look at that log because a campsite network gets abused and because two hundred caravans is a lot of devices to keep happy.
Every night, between 01:50 and 02:10, a device associates with access point 7.
It has done since the network went in in 2021. Not every single night, but four or five nights a week, all year, including February when the site is shut and there is nobody on it.
Its MAC begins 02:60:8C.
That prefix belongs to 3Com. Specifically to the old 3Com Etherlink range, and the 02:60:8C block is one of the most recognisable prefixes in networking because those cards were everywhere in the late eighties and early nineties.
3Com as a company lasted until 2010, when HP bought it. The 02:60:8C block is older than that: it is from the original Etherlink era, and a card carrying it is an ISA or early PCI Ethernet card from somewhere between 1987 and the mid nineties.
Those are wired cards. They are not wifi. There is no version of an Etherlink II that can associate with a WPA2 network, because the hardware predates the concept by a decade, and the card is a full length ISA board with a coaxial socket on the back.
I know what you do with a MAC you do not like, and I have done all of it.
Blocked it. The controller has a deny list and I put it on in 2021. The association log shows it associating. A blocked client shows in the log as a rejected association, which is a different event, and that is not what is recorded. It joins.
Changed the password. Four times. The log records the association as authenticated, which means the four way handshake completed, which means the device had the key.
Changed the SSID. Twice, and once to a hidden one, which means a device has to know the name to find it at all.
Replaced access point 7. Twice, second time a different manufacturer, which meant a different controller, a different log format, and a fresh database.
02:60:8C, every night, between ten to two and ten past.
Somebody spoofing a MAC is the obvious answer and it is a good one.
Anybody can set their wifi adapter's MAC to anything, and a person who does that has usually picked something from a list, and an old 3Com prefix is exactly the kind of thing a person picks as a joke.
Four things argue against it, and I would not have written this down for any one of them.
It happens when the site is closed. Gate locked, fields empty, nobody within three hundred metres except me and my wife in the house, and the house is on the other side of the site from access point 7.
The signal strength is consistent. It associates at between minus fifty eight and minus sixty two dBm, every time, for four years, which is a device sitting in the same place to within a few metres. A person with a laptop does not sit in the same spot to within a few metres four hundred times.
It never does anything. A client that joins and then uses the network shows traffic. This one associates, sits there for between nine and forty minutes, and leaves. No DHCP lease requested on the newer controller, which is its own oddity, because a device that has authenticated normally wants an address.
And access point 7 is on a pole in the middle of the lower field with nothing round it.
Where minus sixty dBm is, from access point 7, is about thirty five to forty five metres.
I walked it out with a phone and a signal app and then I did it properly with a spectrum analyser I borrowed, and the ring of ground that gives you that reading through no walls is a circle about forty metres out.
Forty metres from the pole in the direction of the hedge is the old toilet block.
It has not been a toilet block since 2009. It is a brick shell with the roof on and the windows bricked up and a steel door, and it is full of mowers and a broken rotavator and about two hundred fence posts. There is no power in it. The consumer unit was taken out and the supply cut back at the distribution board in the workshop, and I did that myself.
Forty metres the other way is the hedge and then the lane.
I have been in the block at two in the morning once, in the August of 2022, with a torch and a laptop showing the association log live on a mobile hotspot.
It associated at 01:57 while I was standing inside the door.
There is nothing in there. Mowers, posts, a rotavator, a stack of green plastic chairs, cobwebs, and the smell of a building that has been shut since 2009.
I held the laptop up and walked the inside of it, and the signal from access point 7 is weak in there because of the brick and the bricked up windows, about minus seventy eight, which is worse than the thing in the log by sixteen decibels.
So whatever is sitting at minus sixty is not inside the block. It is outside it, near it, in the open field, about forty metres from the pole.
I went out and stood where I thought that was and turned the torch off, because the log was still showing it associated and I wanted to listen.
It disassociated at 02:06 and I walked back up to the house.
What I have done since is change one thing in the configuration and it is a thing I would defend in any professional conversation.
Access point 7's radio now shuts down between one and three in the morning. There is a schedule feature for exactly that, it saves power, and there is never a legitimate client on the lower field at that hour.
The log has been quiet since, because a radio that is off records nothing.
What I did not expect, and what I have told nobody at all, is that access point 6, which is two hundred and ten metres away at the top of the site, started logging an association at about five past two, at minus sixty one dBm, in the November.
I have worked out where minus sixty one from access point 6 is, the same careful way, with the analyser, over two evenings.
It is the corner of my own garden.