2

I have a verizon HTC One M8 running Android 6.0. I recently noticed that the network name that appears on my routers DHCP list for this device is "X2E GmbH". I confirmed that this device is indeed my phone by comparing the MAC address, but I can find no information where this network name came from.

This seems awfully suspicious as the first result for X2E GmbH on google results with a German company which sells datalogging equipment. This is not a rooted phone, so it seems more likely that the network name change may have come from something malicious within my computer network.

Does the network name originate from my phone? What should a default network name be?

  • Could you verify that Settings -> Developer Options -> Hostname (at the bottom normally) shows the same value? If you don't have dev options enabled, go to Settings -> Device Info and rapidly click the build number a few times. Then go back and check the developer options. – ionree Apr 10 '16 at 20:01
  • I can access the "Developer Options" menu, but I can not view the "Hostname" value. From my research, it is because this is not a rooted phone. @ionree – Doug Apr 10 '16 at 20:10
  • Good point. At this point I think I can only do research myself, and you seem to have done plenty yourself. Here's just what I'm thinking: It seems to be impossible to change the hostname without root. This leaves two options: Something secretly backdoored root access, or something on your network is spoofing your device. The latter is more likely, yet also more scary. Try changing your WiFi password, restarting the router and only connecting with your phone. – ionree Apr 10 '16 at 20:16
  • 1
    Interesting, it appears you are right. I assumed there was a bit of a translation issue and that Automotive ~ "Automated" and that BUS was in the sense of serial bus, not school bus. Seems like a legit company despite the lackluster website design (also suspicious). I concur that it couldn't have come from the phone. I have checked my DHCP lease log and it shows what I expected to see for hostname: "android-xxxxxx..." @ionree – Doug Apr 10 '16 at 20:34
  • 1
    @ionree LINK It appears someone else had a similar occurrence. We have the same router, and I did recently (3 weeks ago) update to Marshmallow. I can't think of any logical reason as to why any sort of update would change the client name to an arbitrary company name (unless a clever programmer at google inserted a few fun lines of code) – Doug Apr 11 '16 at 2:20
2

Ok. I have figured it out. I've learned quite a bit trying to figure this out, I don't have all the details but here is my Hypothesis:

I believe it is a bug in my router. The router performs a search on the IEEE Standards website to look up the manufacturer of each device based on the first three "octets" of the MAC address WIKI. The first three octets (xx:xx:xx) of the MAC address are unique to the manufacturer of the device. For me, my phone is HTC and so the first three octets for HTC are "50:2E:5C". The router must have a bug where it is doing a search and pulling the first manufacturer from the result and using that manufacturer name as the "Client Name". For instance, for my device: Example you'll notice the first hit is "X2E GmbH" which is what my phone is showing up as in my Client List. I don't know why only the android device seems to have the Client Name replaced by this result from the IEEE lookup and not other devices (as all the manufacturers are incorrect, but the client names are correct), but I think it is enough energy spent solving this mystery.

  • From my experience of messing with DHCP, normally clients communicate back and forth with the router a fair bit to prove their identity and whatnot. On android, this behavior is sometimes absent, which may contribute to what you're seeing. – ionree Apr 11 '16 at 5:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.