Weird problem: I can ping, but can not physically find a router !

[emboha]

Situation:

server 2012 who acts as a dhcp and dns server

several access points with fixed ip adresses outside the scope of the dhcp. All have wpa2 aes password.

 

problem:

since 2 days some laptops don't have internet when they connect (successfully) to an accesspoint (other laptops work with that access point)

=> ipconfig tells me they connect to a different router (192.168.0.1), when I go to http://192.168.0.1 I am greeted with a login page from conceptronic (default admin admin wants to load a page but stays blank after 5 min of searching, other passwords give me a login error)

When i give the problem laptops a fixed ip and gateway, all is good. Only on automatic dhcp it chooses that wrong router somehow.

 

I do not use the brand conceptronic anywhere in the building... so I am guessing that router is somehow connected wirelessy with my wireless network? Sugestions?

[w-clarke101]

Look to see if you have if you have more the one device with the some IP address is a good start! What router is it?

[emboha]

it's a whole other subnet:

 

dhcp range for my computers: 192.168.1.10-192.168.1.230. My accesspoints start at 192.168.1.233-243 with the dhcp and dns server somewhere above that: no leases are the same (checked)

 

the router is 192.168.0.1 apparantly and it's a conceptronic, but since it's not one of my own (i never bought something from conceptronic) i can't give u other specifications....

Edited November 5, 2013 by emboha

[gwendes]

Something, somewhere is just running it's own DHCP. Try and track it down it's probably just an AP - are there any odd wireless SSIDs around?

[w-clarke101]

Ok I see you have a Rogue AP some where on your network? yeah Maybe try an wifi app on your phone and have a walk round!

[emboha]

heh, i got into the admin console with some other standard password. Changed the admin password and messed up the settings up(disabled dhcp etc) (I know, I'm evil ;-) ) so now the laptops are connecting fine.

He can always hard reset the thing, but since it was standard password protected, i don't think he knows a lot about these kind of things...

 

When the problem occurs again, i'll have a lookout for some rogue AP's in the building with my smartphone.

Edited November 5, 2013 by Dos_Box

[jonnykewell1]

if they are auto connecting to the wifi with the same SID does this mean that the person (assuming you think it's someone messing around) knows your wifi password to make it auto connect or do you think he has joined the laptop to the wifi himself?

[w-clarke101]

Can always download network monitor called The Dude from Mikro Tik and will give you an idea where it is ( what switch on )

[gwendes]

heh, i got into the admin console with some other standard password. Changed the admin password and fucked the settings up(disabled dhcp etc) (I know, I'm evil ;-) ) so now the laptops are connecting fine.

He can always hard reset the thing, but since it was standard password protected, i don't think he knows a lot about these kind of things...

 

When the problem occurs again, i'll have a lookout for some rogue AP's in the building with my smartphone.

 

I'd have looked at the SSID it was dishing out and tracked it down (feeling all Columbo!)

[gwendes]

if they are auto connecting to the wifi with the same SID does this mean that the person (assuming you think it's someone messing around) knows your wifi password to make it auto connect or do you think he has joined the laptop to the wifi himself?

 

Or there's no security and the kids have just been clicking on it...

Edited November 5, 2013 by gwendes

[LosOjos]

Could have been a rookie attempt at a man in the middle attack - I'd be trying to track that AP down and find out what it's doing on your network

[jonnykewell1]

Yeah I thought that afterwards gwendes but then would it say unsecured?

[gwendes]

Yeah I thought that afterwards gwendes but then would it say unsecured?

 

It would if you found it.

 

Wouldn't worry - most of the time I've found old routers/APs they've just been from a test environment that wasn't properly decommissioned or a member of staff trying to 'help' by bringing in old kit from home!

[emboha]

I connected the laptop to the right AP myself (the one i installed and is protected) and even then, it got a wrong default gateway.

For now, the problem is gone since i disabled the dhcp on the roque AP, but i will definetly track it down, if next time, it pops up again.

[catch21]

One really basic rule I enforce is...you don't connect anything to my network that hasn't been given to you to connect. (Yeah they probably think the same as you're thinking but at least the network stands a chance of working when they want it.)

[emboha]

Ok, it happens again. I've walked around the building and i can't seem to locate anything out of the ordinary (no conceptronic devices).

What the easiest way to get the mac adres from that device? Only thing i know now is that it is a conceptronic device and has the 192.168.0.1 ip-adres (which is outside my subnet).

Can't access the admin page of the device most of the time (sometimes it works but very slow).

[emboha]

Ok, i got the mac adres from the admin page of the device.

I think its a modem.

It gives me two mac's:

00 80 ** ** ** 08

00 80 ** ** ** 09

(used some * instead of real numbers)

Where do i block these mac's? I can't block them in my AP's (basic models)

[CHR1S]

192.168.0.1 is the default IP for a lot of kit.

 

As others have said it could be some rogue AP or something more malicious like a MITM attack. The fact you were able to connect and disable DHCP etc then have it come back points to it being wired and plugged in somewhere (Unless someone knows your wifi password) Either way it sounds dodgy to me.

 

If you can provide another two numbers of each MAC I can narrow your search down.

Edited November 7, 2013 by CHR1S

[emboha]

ethernet mac: 00 80 5A 4C 48 08

DSL MAC: 00 80 5A 4C 48 09

 

I don't think it's something malicious otherwise i wouldn't be able to enter it's admin console with the standard password.

Edited November 7, 2013 by emboha

[CHR1S]

MAC is for -

 

Search results for "00805A" (Total: 2)

 

Prefix Vendor

00805A Tulip Computers International BV

00805A Tulip Computers International BV

[emboha]

idd, it's a company that doesn't exist anymore.

I've changed all the AP's passwords yesterday and still today, it gave me problems, so i'm guessing its connected to my wired network somewhere?

 

I'm guessing, tomorrow will be problematic again, cause to my knowledge, my AP's are secure a.t.m. with the new password (and still it was connected today).

I've disabled it's dhcp-server option again and all is fine at the moment.

Edited November 7, 2013 by emboha

[CHR1S]

set up a hub (if you have one) and wireshark running on a PC with those MAC's filtered and see what its doing.

[budgester]

Can you track which port it's connected to on your switches ?

 

Is your DHCP server dishing out an address ?

[emboha]

Can you track which port it's connected to on your switches ?

=> I'll check tomorrow. It's the first time I will use a manageable switch tho, can't be hard ;-)

 

my win2012 server only gives out ip adresses in the range i want it to so i don't think it gives an adress to the rogue device...

I can't find it in the list of leases anyhow...

 

[twin--turbo]

Can you track which port it's connected to on your switches ?

=> I'll check tomorrow. It's the first time I will use a manageable switch tho, can't be hard ;-)

 

my win2012 server only gives out ip adresses in the range i want it to so i don't think it gives an adress to the rogue device...

I can't find it in the list of leases anyhow...

 

 

 

 

Use android wifi analyser to track it down by signal strength?