Someone is connected to my wireless network
scrooch, Tue Nov 30 2010, 07:04AMOk so i was going through the DHCP client list in my router webpage, and there was this computer that does not belong to us.
It says
192.168.169.2 LeeChehWei-PC 00:1d:e0:80:cd:b1
Now i also checked the IP pool that the router is using.
192.168.169.2 is not in that pool as it only goes from 192.168.2.2 to 192.168.2.100
what is this machine?
How did it manage to connect?
Re: Someone is connected to my wireless network
Pinky's Brain, Tue Nov 30 2010, 10:36AM
Maybe it allows addresses outside of the pool if specifically requested or something.
What kind of security are you using?
Pinky's Brain, Tue Nov 30 2010, 10:36AM
Maybe it allows addresses outside of the pool if specifically requested or something.
What kind of security are you using?
Re: Someone is connected to my wireless network
Adam Munich, Tue Nov 30 2010, 11:45AM
Possibly just a person enjoying an open wifi network, --a rare thing nowadays.
I say share the love, it's not like you get charged by the megabyte.
Adam Munich, Tue Nov 30 2010, 11:45AM
Possibly just a person enjoying an open wifi network, --a rare thing nowadays.
I say share the love, it's not like you get charged by the megabyte.
Re: Someone is connected to my wireless network
Thomas W, Tue Nov 30 2010, 03:43PM
id put a watch on what there doing on your network they could be donwloading illigel stuff ect :S
Thomas W, Tue Nov 30 2010, 03:43PM
id put a watch on what there doing on your network they could be donwloading illigel stuff ect :S
Re: Someone is connected to my wireless network
Steve Conner, Tue Nov 30 2010, 05:19PM
Maybe they're connected to the WAN side of it.
It's either some guy at the ISP administering your router, or a really leet hacker.
Steve Conner, Tue Nov 30 2010, 05:19PM
Maybe they're connected to the WAN side of it.
It's either some guy at the ISP administering your router, or a really leet hacker.
Re: Someone is connected to my wireless network
Nicko, Tue Nov 30 2010, 05:58PM
[quote]
Ok so i was going through the DHCP client list in my router webpage, and there was this computer that does not belong to us.
It says
Now i also checked the IP pool that the router is using.
192.168.169.2 is not in that pool as it only goes from 192.168.2.2 to 192.168.2.100
what is this machine?
How did it manage to connect?
[/quote1291139448]
Are you encrypting your access point? If not, you should be.
The guy has connected with a class B address - this is possible with some routers, even if their own DHCP pool is a different class altogether - if he intruder sets a static IP and gets lucky, then its your problem. Anything under 192.168.*.* is for "local" use - some routers allow anything in that class B range by default.
If this is a domestic setup, make sure everything is in a specific class C range, in your case 192.168.2.* - the mask needed is then 255.255.255.0 - this should be on every bit of kit on the internal side of your network.
You need to up your encryption - if you already have it encrypted, change the key and up the length, then reset the key in all your clients.
What router do you have?
In my last job, we had a similar thing which turned out to be the night security guard bringing in a laptop to watch dodgy movies - he just looked for a spare CAT5e point and plugged in - I made all ports lock to a specific MAC address after that and set up alarms & honey pots to trap further attempts...
Cheers
Nicko, Tue Nov 30 2010, 05:58PM
[quote]
Ok so i was going through the DHCP client list in my router webpage, and there was this computer that does not belong to us.
It says
192.168.169.2 LeeChehWei-PC 00:1d:e0:80:cd:b1
Now i also checked the IP pool that the router is using.
192.168.169.2 is not in that pool as it only goes from 192.168.2.2 to 192.168.2.100
what is this machine?
How did it manage to connect?
[/quote1291139448]
Are you encrypting your access point? If not, you should be.
The guy has connected with a class B address - this is possible with some routers, even if their own DHCP pool is a different class altogether - if he intruder sets a static IP and gets lucky, then its your problem. Anything under 192.168.*.* is for "local" use - some routers allow anything in that class B range by default.
If this is a domestic setup, make sure everything is in a specific class C range, in your case 192.168.2.* - the mask needed is then 255.255.255.0 - this should be on every bit of kit on the internal side of your network.
You need to up your encryption - if you already have it encrypted, change the key and up the length, then reset the key in all your clients.
What router do you have?
In my last job, we had a similar thing which turned out to be the night security guard bringing in a laptop to watch dodgy movies - he just looked for a spare CAT5e point and plugged in - I made all ports lock to a specific MAC address after that and set up alarms & honey pots to trap further attempts...
Cheers
Re: Someone is connected to my wireless network
TechMojo, Tue Nov 30 2010, 08:59PM
Don't miss a great opportunity, fire up a sniffer like Snort. Filter the traffic to that IP and see what he is up to! He could be doing something illegal through your public IP!
TechMojo, Tue Nov 30 2010, 08:59PM
Don't miss a great opportunity, fire up a sniffer like Snort. Filter the traffic to that IP and see what he is up to! He could be doing something illegal through your public IP!
Re: Someone is connected to my wireless network
Adam Munich, Wed Dec 01 2010, 01:13AM
Or it could just be a child enjoying the internet on his PSP...
Adam Munich, Wed Dec 01 2010, 01:13AM
Or it could just be a child enjoying the internet on his PSP...
Re: Someone is connected to my wireless network
scrooch, Wed Dec 01 2010, 01:56AM
thanks for the responses guys. I think ill just kick him by changing the password and maybe ban his mac address.
still beats me how he managed to get a ip address out side of the pool.
my router is a belkin "share" router
scrooch, Wed Dec 01 2010, 01:56AM
thanks for the responses guys. I think ill just kick him by changing the password and maybe ban his mac address.
still beats me how he managed to get a ip address out side of the pool.
my router is a belkin "share" router
Re: Someone is connected to my wireless network
Conundrum, Wed Dec 01 2010, 04:25PM
heh.
sounds like someone around might be using a cantenna.
i agree it probably isn't a good idea to leave the wireless unlocked, in case someone is using it to send spam/download dodgy stuff/etc.
For security reasons I recommend getting a printout of the mac address and times connected etc in case this gets ugly.
-A
Conundrum, Wed Dec 01 2010, 04:25PM
heh.
sounds like someone around might be using a cantenna.
i agree it probably isn't a good idea to leave the wireless unlocked, in case someone is using it to send spam/download dodgy stuff/etc.
For security reasons I recommend getting a printout of the mac address and times connected etc in case this gets ugly.
-A
Re: Someone is connected to my wireless network
dingo27, Wed Dec 08 2010, 01:58PM
I wonder what you will say when they charge you from uploading illegal stuff for wikileaks. Its not a good idea to have open wifi connection.
I dont know what type of router are you using, but be sure thet its not any adress a router is using and after that ban him in mac list. One time i saw something similar, banned and it was some adress my router was using (i always see IP of computers + IP of router). I ended up reseting it :)
Share the love but only with people you trust. Its you who is responsible for activity on your internet connection.
dingo27, Wed Dec 08 2010, 01:58PM
Grenadier wrote ...
I say share the love, it's not like you get charged by the megabyte.
I say share the love, it's not like you get charged by the megabyte.
I wonder what you will say when they charge you from uploading illegal stuff for wikileaks. Its not a good idea to have open wifi connection.
I dont know what type of router are you using, but be sure thet its not any adress a router is using and after that ban him in mac list. One time i saw something similar, banned and it was some adress my router was using (i always see IP of computers + IP of router). I ended up reseting it :)
Share the love but only with people you trust. Its you who is responsible for activity on your internet connection.
Re: Someone is connected to my wireless network
Conundrum, Sun Dec 19 2010, 02:15PM
Could be an internet connected device such as a plugport, or something like that.
-A
Conundrum, Sun Dec 19 2010, 02:15PM
Could be an internet connected device such as a plugport, or something like that.
-A
Re: Someone is connected to my wireless network
..., Sun Dec 19 2010, 07:57PM
Most likely you are using WEP, and one of your neighbors has cracked your password--it is quite trivial to break WEP encryption.
Per the address, you can manually set your address to anything you want, some routers will ignore clients that don't have an address in the right range (some even ignore any clients that didn't get an address assigned to it from the router), but many will happily route traffic to any address you want, you just need to set your subnet mask correctly to allow it.
That said, it is truly sad, but in this day and age where you are personally liable for anything that is downloaded from your modem it not safe to have an access point open, or even encrypted with WEP. One would hope it is just someone who wanted to check their e-mail, but it could also be someone downloading illegal warez looking for an unsuspecting family to take the blame instead of himself/his parents.
..., Sun Dec 19 2010, 07:57PM
Most likely you are using WEP, and one of your neighbors has cracked your password--it is quite trivial to break WEP encryption.
Per the address, you can manually set your address to anything you want, some routers will ignore clients that don't have an address in the right range (some even ignore any clients that didn't get an address assigned to it from the router), but many will happily route traffic to any address you want, you just need to set your subnet mask correctly to allow it.
That said, it is truly sad, but in this day and age where you are personally liable for anything that is downloaded from your modem it not safe to have an access point open, or even encrypted with WEP. One would hope it is just someone who wanted to check their e-mail, but it could also be someone downloading illegal warez looking for an unsuspecting family to take the blame instead of himself/his parents.
Re: Someone is connected to my wireless network
cedric, Mon Jun 20 2011, 12:59PM
plus the chance that some one upload to wikileak using your connection is ridiculously small,unless you leave next to a Diplomatic house...
cedric, Mon Jun 20 2011, 12:59PM
dingo27 wrote ...
I wonder what you will say when they charge you from uploading illegal stuff for wikileaks. Its not a good idea to have open wifi connection.
I dont know what type of router are you using, but be sure thet its not any adress a router is using and after that ban him in mac list. One time i saw something similar, banned and it was some adress my router was using (i always see IP of computers + IP of router). I ended up reseting it :)
Share the love but only with people you trust. Its you who is responsible for activity on your internet connection.
ha ,but it's easy:I don't know who did this ,I have an open connection.Grenadier wrote ...
I say share the love, it's not like you get charged by the megabyte.
I say share the love, it's not like you get charged by the megabyte.
I wonder what you will say when they charge you from uploading illegal stuff for wikileaks. Its not a good idea to have open wifi connection.
I dont know what type of router are you using, but be sure thet its not any adress a router is using and after that ban him in mac list. One time i saw something similar, banned and it was some adress my router was using (i always see IP of computers + IP of router). I ended up reseting it :)
Share the love but only with people you trust. Its you who is responsible for activity on your internet connection.
plus the chance that some one upload to wikileak using your connection is ridiculously small,unless you leave next to a Diplomatic house...
Re: Someone is connected to my wireless network
Hon1nbo, Mon Jun 20 2011, 05:08PM
people do have caps on home internet now, so boot him! AT&T (/SBC Global etc) bow have a 100GB cap for DSL and 250GB for U-Verse, they didn't even try to really tell us I just keep up with such things by chance!
But anyways, yeah change the keys, and KEEP THE LOGS! If the person was doing something illegal keep the evidence of it.
just my 2c, Jimmy
Hon1nbo, Mon Jun 20 2011, 05:08PM
people do have caps on home internet now, so boot him! AT&T (/SBC Global etc) bow have a 100GB cap for DSL and 250GB for U-Verse, they didn't even try to really tell us I just keep up with such things by chance!
But anyways, yeah change the keys, and KEEP THE LOGS! If the person was doing something illegal keep the evidence of it.
just my 2c, Jimmy
Re: Someone is connected to my wireless network
Carbon_Rod, Tue Jun 21 2011, 06:19AM
00:1D:E0 MAC prefix is an Intel Network card
Some users machines/cellphones may simply auto-connect to any open network.
MAC spoofing is less common, but even WPA2 PSK can't stop offline busting of a weak password.
Or if you are interested in forensics... solve the problem...
kismet + GPS + Trilateration (ARRL adaptive attenuators are easy to build)
...but this forum is not really keen on these kinds of nuisances...
Try:
* WPA2
* PSK (a really long random string)
* lower your router's transmit power to just above signal loss
* turn off cross forwarding LAN traffic for wireless interfaces
Cheers,
Rod
Carbon_Rod, Tue Jun 21 2011, 06:19AM
00:1D:E0 MAC prefix is an Intel Network card
Some users machines/cellphones may simply auto-connect to any open network.
MAC spoofing is less common, but even WPA2 PSK can't stop offline busting of a weak password.
Or if you are interested in forensics... solve the problem...
kismet + GPS + Trilateration (ARRL adaptive attenuators are easy to build)
...but this forum is not really keen on these kinds of nuisances...
Try:
* WPA2
* PSK (a really long random string)
* lower your router's transmit power to just above signal loss
* turn off cross forwarding LAN traffic for wireless interfaces
Cheers,
Rod
Print this page