+ Post New Thread
Page 2 of 3 FirstFirst 123 LastLast
Results 16 to 30 of 39
Wireless Networks Thread, Weird problem: I can ping, but can not physically find a router ! in Technical; Ok, it happens again. I've walked around the building and i can't seem to locate anything out of the ordinary ...
  1. #16

    Join Date
    Jun 2013
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    Ok, it happens again. I've walked around the building and i can't seem to locate anything out of the ordinary (no conceptronic devices).
    What the easiest way to get the mac adres from that device? Only thing i know now is that it is a conceptronic device and has the 192.168.0.1 ip-adres (which is outside my subnet).
    Can't access the admin page of the device most of the time (sometimes it works but very slow).

  2. #17

    Join Date
    Jun 2013
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    Ok, i got the mac adres from the admin page of the device.
    I think its a modem.
    It gives me two mac's:
    00 80 ** ** ** 08
    00 80 ** ** ** 09
    (used some * instead of real numbers)
    Where do i block these mac's? I can't block them in my AP's (basic models)

  3. #18

    CHR1S's Avatar
    Join Date
    Feb 2006
    Location
    Birmingham
    Posts
    4,514
    Thank Post
    1,590
    Thanked 495 Times in 307 Posts
    Rep Power
    219
    192.168.0.1 is the default IP for a lot of kit.

    As others have said it could be some rogue AP or something more malicious like a MITM attack. The fact you were able to connect and disable DHCP etc then have it come back points to it being wired and plugged in somewhere (Unless someone knows your wifi password) Either way it sounds dodgy to me.

    If you can provide another two numbers of each MAC I can narrow your search down.
    Last edited by CHR1S; 7th November 2013 at 02:01 PM.

  4. #19

    Join Date
    Jun 2013
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    ethernet mac: 00 80 5A 4C 48 08
    DSL MAC: 00 80 5A 4C 48 09

    I don't think it's something malicious otherwise i wouldn't be able to enter it's admin console with the standard password.
    Last edited by emboha; 7th November 2013 at 02:19 PM.

  5. #20

    CHR1S's Avatar
    Join Date
    Feb 2006
    Location
    Birmingham
    Posts
    4,514
    Thank Post
    1,590
    Thanked 495 Times in 307 Posts
    Rep Power
    219
    MAC is for -

    Search results for "00805A" (Total: 2)

    Prefix Vendor
    00805A Tulip Computers International BV
    00805A Tulip Computers International BV

  6. #21

    Join Date
    Jun 2013
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    idd, it's a company that doesn't exist anymore.
    I've changed all the AP's passwords yesterday and still today, it gave me problems, so i'm guessing its connected to my wired network somewhere?

    I'm guessing, tomorrow will be problematic again, cause to my knowledge, my AP's are secure a.t.m. with the new password (and still it was connected today).
    I've disabled it's dhcp-server option again and all is fine at the moment.
    Last edited by emboha; 7th November 2013 at 02:36 PM.

  7. #22

    CHR1S's Avatar
    Join Date
    Feb 2006
    Location
    Birmingham
    Posts
    4,514
    Thank Post
    1,590
    Thanked 495 Times in 307 Posts
    Rep Power
    219
    set up a hub (if you have one) and wireshark running on a PC with those MAC's filtered and see what its doing.

  8. #23
    budgester's Avatar
    Join Date
    Jan 2006
    Location
    Enfield, Middlesex
    Posts
    486
    Thank Post
    4
    Thanked 37 Times in 30 Posts
    Rep Power
    24
    Can you track which port it's connected to on your switches ?

    Is your DHCP server dishing out an address ?

  9. #24

    Join Date
    Jun 2013
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    Can you track which port it's connected to on your switches ?
    => I'll check tomorrow. It's the first time I will use a manageable switch tho, can't be hard ;-)

    my win2012 server only gives out ip adresses in the range i want it to so i don't think it gives an adress to the rogue device...
    I can't find it in the list of leases anyhow...


  10. #25

    twin--turbo's Avatar
    Join Date
    Jun 2012
    Location
    Carlisle
    Posts
    2,334
    Thank Post
    1
    Thanked 381 Times in 340 Posts
    Rep Power
    150
    Quote Originally Posted by emboha View Post
    Can you track which port it's connected to on your switches ?
    => I'll check tomorrow. It's the first time I will use a manageable switch tho, can't be hard ;-)

    my win2012 server only gives out ip adresses in the range i want it to so i don't think it gives an adress to the rogue device...
    I can't find it in the list of leases anyhow...



    Use android wifi analyser to track it down by signal strength?

  11. #26
    budgester's Avatar
    Join Date
    Jan 2006
    Location
    Enfield, Middlesex
    Posts
    486
    Thank Post
    4
    Thanked 37 Times in 30 Posts
    Rep Power
    24
    But the DHCP server would have a list of host names, anything stand out ?

  12. #27

    twin--turbo's Avatar
    Join Date
    Jun 2012
    Location
    Carlisle
    Posts
    2,334
    Thank Post
    1
    Thanked 381 Times in 340 Posts
    Rep Power
    150
    Also on the rouge device web console, what is the product name so you can look at what it looks like.

    Rob

  13. #28

    Join Date
    Jun 2013
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    The name is SKYNET_BE, and it is not on my server's dhcp list, not by that name, and not by that mac adress.
    I'll walk around the building tomorrow with the wifi analyser tool and search for that SSID. I'll keep u guys posted, thx for all the help allready ;-)

  14. #29

    Join Date
    Feb 2011
    Location
    Dudley
    Posts
    125
    Thank Post
    18
    Thanked 32 Times in 22 Posts
    Rep Power
    13
    Quote Originally Posted by emboha View Post
    I'll keep u guys posted
    Well.. did you find it already?? It's been a week - I'm ready for the next chapter...

  15. #30

    Join Date
    Oct 2005
    Posts
    849
    Thank Post
    51
    Thanked 115 Times in 105 Posts
    Rep Power
    74
    What sort of switches have you got?
    Most will let you do a "Show mac-address 11:22:33:44:55" type command and show you which port it's connected to... makes life a LOT easier.

SHARE:
+ Post New Thread
Page 2 of 3 FirstFirst 123 LastLast

Similar Threads

  1. Client can ping server but server cant ping client
    By KevWCFE in forum Wireless Networks
    Replies: 6
    Last Post: 20th May 2011, 03:22 PM
  2. VPN: can connect but ip not correctly issued....
    By kennysarmy in forum Windows Server 2000/2003
    Replies: 10
    Last Post: 9th September 2010, 12:52 PM
  3. Holiday booked but can we change hotel now?
    By ranj in forum General Chat
    Replies: 1
    Last Post: 22nd June 2008, 10:14 AM
  4. Can Receive But Cannot Send E-Mail
    By DaveP in forum Wireless Networks
    Replies: 7
    Last Post: 14th November 2007, 08:26 AM
  5. Replies: 8
    Last Post: 21st June 2006, 05:49 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •