Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[sheddyian]

Curious thing :

I've seen two devices, unknown to me, granted ip addresses by my router DHCP.

I can't say when they were given the address, as they're no longer in the poorly detailed log that the router keeps.

One of them a few weeks back, identified itself as "Toshiba Laptop" - I don't have such a computer, nor does anyone I know.
It wasn't pingable on the ip address it had earlier been given, so I don't know how long it was there for.

The other I've just noticed, which is a computer that WakeMeOnLan  (http://www.nirsoft.net/utils/wake_on_lan.html ) picked up at some point and I've only just noticed - a computer with a network device manufactured by "PRO-Nets Technology Corporation".

Because I think I would have noticed if someone was physically plugging devices into my LAN, I'm assuming these were wireless devices.

If someone is passing, and tries to get access to my lan by wireless, but doesn't know the password, will they still be granted an ip address whilst they try?

ie Should I worry about these DHCP address grants, or are they just transient devices that are seeking a wireless network?
Are they symptoms of successful access to my network, someone trying and failing to get access, or what?

What does the team think?

Ian

[burakkucat]

Good questions. I confess that I do not have an answer. 

I've managed to convince myself both 'this way' and 'that way'  . . . 

[kitz]

Ip address allocation occurs before authentication.

Ie the remote machine must be allocated an ip to be able to start the authentication process.

[sheddyian]

Ip address allocation occurs before authentication.

Ie the remote machine must be allocated an ip to be able to start the authentication process.

Thanks!  That's reassured me a bit (that it's probably transient devices seeking a wireless connection), though I might change my WLAN  access password anyway 


Ian

[tickmike]

Use something like 'WireShark'  network protocol analyzer to have a look.    

http://www.wireshark.org/about.html

 http://www.wireshark.org/download.html

http://nmap.org/

 Edit.. If you have there IP Address do a 'WhoIs' on them.

Also turn OFF your wireless if you do not need it.

[sevenlayermuddle]

Interesting topic, that I'd never thought about.

I have acquaintances who won't hesitate to chance their arm and try to hitch a free ride on neighbours' WiFis when away from home, maybe visiting friends and relatives.   They might think twice if they knew a glance at the router GUIs would give them away.

[kitz]

Its late and Im typing this on the ipad so am not able to provide any resources.. Im typing off the top of my head and am happy to be corrected.  Interesting subject indeed and why I cant help but comment despite the late hour and the need to be up early tomorrow am.

---

DHCP and authentication are entirely separate processes.   If you think about it, an IP address needs to be allocated to the remote device to be able to 'talk to the router' so it can in turn exchange information in order to be authenticated on the network.

Basic DHCP does not have any authentication, but there are ways and means around this such as RADIUS servers and x.( 2? something which I cant recall) which are commonly used for large networks and ISPs, to ensure authentication occurs before IP allocation.  Even then i think theres an unauthorised/authorised stage of the IP pool.

afaik its not a simple scan that triggers off DHCP allocation, but the act of attempting to communicate with the router such as to authenticate on to the local network or login to the router interface.  It could simply be someone trying their luck such as a neighbour to see if you have default passwords and hitch a free ride.  Something I bet most of us have tried at some time.

I would think that wireshark would be pretty useless, even if someone doesnt bother to cover their tracks, then the information would only be the LAN IP allocated by DHCP, the machine name and the MAC address.   

You may be able to get further info from router logs if authentication was attained or not.. but I think most home routers may only log access to the router interface... therefore what info you do have wont gain you much aside from perhaps having the MAC to block future attempts.... or if the machine name is 'Billy' and you know that next doors teenager is called William. 

Something that needs further info , but iirc there are ways and means which DHCP can be fooled and tricked when hacking into a network, either to lock up the network (DoS type) and/or an experienced hacker/cracker would not leave any trace that he'd been.

[sevenlayermuddle]

Have to say it's caught my interest anyway,  I look forwards to a few experiments - like trashing the laptop or iPad's wi fi key and attempting to connect, then seing what the router can tell me   

[SecTSys]

I always thought that the DHCP IP address allocation was done during the POST boot up of any Device as soon as the router can see it. particularly on wired LAN connections if the device / machine name / MAC address is recognized then it will assign the previously allocated IP Address if that is available or if IP address allocation is set to Static allocations.

personally I turn off the DHCP features and assign each individual computer an allocated IP Address. - this help to add an extra layer of security and prevent Hackers and such getting on the Network.

[les-70]

  I think turning off DHCP does help security but not by much unless an exotic address range and subnet mask is used. 

[sheddyian]

DHCP is very convenient, and works well, so I'd be reluctant to switch it off.

Because I don't know when the two unknown devices attempted (succeeded?) to connect, I suppose what I'd like is to be notified that something new is happening.

Clearly, I don't want to know that my PC or my TV has renewed it's ip address, or even that it's been granted a new one because it's been switched off for a week, but it'd be useful/interesting to have maybe an email sent when a new device (ie new MAC address) requests an ip address for the first time.

Then I could quickly determine : yay, this thing I've repaired is working OR hey, what's that?

I think some routers support syslog, but then I'd need to guarantee another computer is up 100% as a syslog server, wouldn't I?

Ian

[burakkucat]

I think some routers support syslog, but then I'd need to guarantee another computer is up 100% as a syslog server, wouldn't I?

Yes, correct.

[sevenlayermuddle]

I think one reevant issue here may be, and I'm not sure of this, is that some Microsoft OS's will automatically attempt to connect to a WiWi whenever one is detected 

As for enabling/disabling DHCP, I'm not sure it really affects security.   To me, the advantage of avoiding DHCP is less to do with security, and more to do with robustness and avoiding the weaknesses of DHCP.   I have a whiteboard on my wall, which lists my own assigned IP addresses for nearly all my devices. This is good as all are consistently identified with a unique IP and, because they never change, they never conflict.   But it wouldn't stop a hacker from defining another arbitrary address in my subnet and attaching to my network - that (stopping it) is the job of the authentication process.

And for myself, I also have DHCP pool, in a separate range of addresses, for devices I can't be bothered defining, or that belong to visitors who I allow to use the WiFi.   Best of all worlds, I reckon.

[burakkucat]

All regular devices on my LAN at The Cattery have assigned static IP addresses and a wireless connection is not used.

Like 7LM, I have a DHCP server that will hand out IP addresses to temporary devices which have been connected.