3

Context: Personal hotspot connection from iPhone 12 used on my MacBook Air.

Problem: Under Settings - Mobile Data - Personal Hotspot (iPhone), I see 2 data usage components:

1.5 GB - MacBook, and, 20.2 KB - A very suspicious looking MAC address: 4a:f1:1b:3a:7d:86

Further information: I changed password multiple times, but the issue persists. Sometimes, I also see "Other devices"...

What is going on? Is my security in danger? Could this be related to MAC randomisation?

Improve this question
7
  • 1
    Welcome to Ask Different. On your Mac, can you run the following command in Terminal and post the output: arp -l -a? This command displays the IP-to-MAC address translation table. If the unknown MAC address is shown, the IP address could help identify the device (for example, with sudo nmap -O <IP address>. Note that nmap is not part of macOS, but can be installed with Homebrew).
    – jaume
    Commented Mar 2, 2022 at 10:18
  • Thank you Jaume. I will not have access to the hotspot for around a week, but will try as soon as I have the opportunity and update you. Now, if you look at the other answer below, would you agree that it could also be a possibility?
    – randomizedcontrol_932
    Commented Mar 2, 2022 at 13:00
  • jksoegaard's answer is right that we're most probably dealing with a randomized MAC address: according to maclookup.app, the MAC address you see is a locally administered address as opposed to a "real" MAC address. My guess is that your Mac used a randomized MAC address while scanning for known Wi-Fi networks, and then, after connecting to it, if switched to its own MAC address (see support.apple.com/guide/security/wi-fi-privacy-secb9cb3140c/web), that would explain why only 20.2 KB were transferred.
    – jaume
    Commented Mar 2, 2022 at 13:47
  • Update - I checked with Apple Support and they said this: "Okay so I just checked with a colleague it is with only iOS devices (iPhone, iPad and Watch), sorry about that. This feature hasnt been included on the Mac as of right now". So MacOS cannot randomise its MAC address while scanning for known Wi-Fi networks then?
    – randomizedcontrol_932
    Commented Mar 2, 2022 at 20:38
  • 1
    Okay, so you are saying that it might have scanned my hotspot, but did not connect to it? And thats why my security is not in danger
    – randomizedcontrol_932
    Commented Mar 3, 2022 at 10:17

1 Answer 1

Reset to default
0

I do not know why you think that MAC address is "suspicious looking". It is not "suspicious looking" to me.

You can tell from the address itself that it is not a MAC address given to a network interface from factory by a hardware vendor - it is instead a software generated MAC address. This is very typical today - for example used in MAC randomisation, a scheme to protect the user privacy.

There's absolutely nothing here that indicates that your "security is in danger".

Improve this answer
8
  • I appreciate the help! Thank you, but why would my data be used by this MAC address if I know that my MacBook is the only device connected to the personal hotspot being shared from my iPhone?
    – randomizedcontrol_932
    Commented Mar 1, 2022 at 23:39
  • Because that MAC address IS the MacBook.
    – jksoegaard
    Commented Mar 1, 2022 at 23:56
  • Interesting. But the MAC address is different from the Wi-Fi Address on my MacBook (System Report - Network - MAC address). What do you think?
    – randomizedcontrol_932
    Commented Mar 2, 2022 at 0:00
  • Yes, exactly - it is software generated, as I wrote in my answer.
    – jksoegaard
    Commented Mar 2, 2022 at 0:12
  • Thank you very much, so it is randomized (due to MAC address randomization being enabled on my MacBook), in other words?
    – randomizedcontrol_932
    Commented Mar 2, 2022 at 0:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .