[inamberclad]

Probably just ssh enabled with the default credentials. IIRC, raspberry pis have their own MAC address prefix, so it's pretty obvious when you find one.

[fortran77]

My guess is this pi was connecting _out_, tunneling the network over ssh.

Or one of these things: https://blog.haschek.at/2018/the-curious-case-of-the-RasPi-i...