We are a WISP and have been using Pepwave Surf devices since 2008.
We use a captive portal on our networks, running on a Mikrotik router.
All along, we usually see the MAC address (and external IP address) of the user’s Pepwave, and nothing else.
Since the advent of the Surf OTG we are noticing this behavior, and I’m not sure if they all do it or if it is a setting the user selects.
I see the MAC and IP of the Pepwave itself as usual but now also see additional IP addresses (from the same MAC). These are the devices behind the Pepwave. They are showing the “internal” IP assigned by the Pepwave 192.168.20.x
In the screen shot (which is from the router), the 10.5.50.56 address is the normal one I would expect, it was assigned by my DHCP server. I have been seeing these for years.
The others with the same MAC are devices the user has, and since they are leaking through, they use up resources on my system and count as multiple logins for that user.
Why is this happening and how can I stop it?
Thanks for the help