What in the world is going on here? (wireless)

http://i3.photobucket.com/albums/y62/KGhaleon/wtfh.jpg?t=1178944016

I have three or so wireless access points close to me, with two of them being encrypted and the other available for public use. I have AirSnare on this machine that picks up devices on the network...and it's looked normal until a couple days ago.

Suddenly I got what you see in the above picture. Is there an explaination for something like that? I'm refering to all those bogus routers.

KG

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

Ciscopimpenator

I don't know much about wireless but its obvious you have some DHCP traffic going on.

The routers?
I'm not familiar with AiRsnare but looks like fun

Maybe there is a wireless device somewhere around you that's throwing out DHCP requests.
If you tell me the current network setup of the 3 access points(ip address, MAC addresses, whatever) then maybe I could help.

-Ciscopimpenator

tech-airman

KGhaleon wrote:

http://i3.photobucket.com/albums/y62/KGhaleon/wtfh.jpg?t=1178944016

I have three or so wireless access points close to me, with two of them being encrypted and the other available for public use. I have AirSnare on this machine that picks up devices on the network...and it's looked normal until a couple days ago.

Suddenly I got what you see in the above picture. Is there an explaination for something like that? I'm refering to all those bogus routers.

KG

KGhaleon,

Based on information from the "IEEE Registration Authority - IEEE OUI and Company_id Assignments" webpage, here's what I found out.

Unfriendly MAC Addresses
[list=1:df265a401c]
00173F2D4FA4 - Router = A Belkin wireless device

[/list:o:df265a401c]

The public OUI listing contains no match for the rest of the Unfriendly MAC Addresses.

I hope this helps.

Source:

IEEE Registration Authority - IEEE OUI and Company_id Assigments - http://standards.ieee.org/regauth/oui/index.shtml

JDMurray

People, please RTFM: http://home.comcast.net/~jay.deboer/airsnare/guide.html

AirSnare has a "friendly MACs list" that it uses to indicate wireless devices with known MAC addresses. Any MAC address not on this list are automatically placed on the "unfriendly" list. The user must manually update the friendly MAC list.

blackmage439

For one thing, I am sorry to see that you have Belkin equipment. I have had nothing but trouble with my Belkin wireless router. I hope your luck is better than mine.....

Anyway, on to the problem. It seems that at least one of those bogus "routers" (MAC: 00173...) is continually trying to associate to your WLAN. Have you implemented MAC address filtering? Maybe that will stop those bogus devices from getting through.

I also have two questions:

What sort of addressing scheme are you using for your WLAN? I'm guessing it's 192.168....
Could you possibly scroll to the right in the MAC alert window, and post a picture? I'm curious to see what the remaining text in the Event field is...

I don't know a whole lot about WLAN association. But, ever since I implemented MAC address filtering, I don't believe I have ever had a bogus device associate to the LAN... *Makes mental note to check the router's log when I get home*