Introuders on my Internet?!

gjoellee · 2009-03-01 13:54:24

I was changing some settings in my router when I discovered a device which didn't have a IP adress like this: 10.0.0.x, but it has 8x.xx.xx.x

The device name is by default called: Unknown-xx-xx-xx-xx-xx-xx (x=a number or letter). The IP is the same as my own, but with 2 numbers less. Can it by some other person hacking my ROUTER or is it just my self?

I have had some problems with hackers in about a year ago, but I changed the password got a new router since then. It might be the same guy, or can this be some kind of virus? Because I use Arch Linux, by sister uses Xandros, but everone else uses Wndows!

I notice this as well:
-Slow Internet sometimes (every day)
-Sometimes the router just restart, when the Internet is slow then suddenly the Ethernet sometimes stop working sometimes and wireless still work

R00KIE · 2009-03-01 16:02:12

Have you tried googling with: brand_of_router model_of_router IP problem
Have you considered that the "rogue" IP you see is your external IP?

As for slow internet, configure torrent clients to be more friendly (limit number of connection, download and upload speed), also check the windows machines .... you can never trust those, they may have some nasty infection also try disconnecting pc by pc until you figure out which one is sapping bandwidth.

Last edited by R00KIE (2009-03-01 16:04:41)

gjoellee · 2009-03-01 16:54:56

R00KIE wrote:

Have you tried googling with: brand_of_router model_of_router IP problem
Have you considered that the "rogue" IP you see is your external IP?
As for slow internet, configure torrent clients to be more friendly (limit number of connection, download and upload speed), also check the windows machines .... you can never trust those, they may have some nasty infection also try disconnecting pc by pc until you figure out which one is sapping bandwidth.

OK, Thanks

Skripka · 2009-03-01 16:56:19

gjoellee wrote:

I was changing some settings in my router when I discovered a device which didn't have a IP adress like this: 10.0.0.x, but it has 8x.xx.xx.x
The device name is by default called: Unknown-xx-xx-xx-xx-xx-xx (x=a number or letter). The IP is the same as my own, but with 2 numbers less. Can it by some other person hacking my ROUTER or is it just my self?
I have had some problems with hackers in about a year ago, but I changed the password got a new router since then. It might be the same guy, or can this be some kind of virus? Because I use Arch Linux, by sister uses Xandros, but everone else uses Wndows!
I notice this as well:
-Slow Internet sometimes (every day)
-Sometimes the router just restart, when the Internet is slow then suddenly the Ethernet sometimes stop working sometimes and wireless still work

Do you have network security via high power WPA security? If not-then depending on your neighborhood-someone could be "borrowing" your internet.

Easy check:

Check the MAC (Media Access Control) address on all your devices hooked up on your router (on the router software control panel), and check the numbers on all your devices themselves...if you have an MAC you cannot account for-you have an unwanted "guest".

RE: The format of the address "Unknown-xx-xx-xx-xx-xx-xx", if the numbers are hexadecimal numbers-that is an MAC address.

Just looking at it from here-the case looks good for a rogue "guest" on your network.

Simple check-whitelist all your known and desired devices via MAC address on you router, and forbid any other MACs-then only known devices should be able to attach themselves. If your network speed improves-then there's your problem. It is not that hard to fake an MAC address and get through--but MOST people who "borrow" other people's internet connections don't know how, or it isn't worth the trouble.

R00KIE · 2009-03-01 18:04:11

Going with wpa2 when possible with a wireless connection may help a lot in that case, mac address protection is a very weak if you are really motivated into "borrowing" some bandwidth from someone's internet.

Skripka · 2009-03-02 04:49:50

R00KIE wrote:

Going with wpa2 when possible with a wireless connection may help a lot in that case, mac address protection is a very weak if you are really motivated into "borrowing" some bandwidth from someone's internet.

My thought, is if someone has the brains/knowhow/cares enough to crack your MAC whitelist, odds are you're going to be sunk no matter what you do. It is weak, no arguments, but for your stereotypical college-student apartment house neighbor 'net moochers-it is enough to put the kabash on it quick and easy... not all hardware sets deal that well with WPA or WPA2.

Your odds of living with neighbors, in wireless range, who have the computer skills to break MAC whitelisting are probably similar to your odds of getting in a car accident-at least in the US. Lots of people own computers. Only a tiny % (here anyway) know anything more about how to use them than the basic FireFox, Thunderbird, and Word....this of course presumes, that the unwanted "guess" is tapping your wireless router, and not doing something more sneaky. IMHO.

Wireless is more trouble than it is worth. Getting two computer to talk to one another is an unnatural act, and doing so without wires is voodoo. My tower takes a 50' cat6 to the router, old school style

Last edited by Skripka (2009-03-02 04:50:48)

R00KIE · 2009-03-02 09:28:21

Well yes, cable is always the best thing and it will make life much easier when installing linux with an ftp install .
Also some routers may have a flaw that will allow you to connect even when you have mac address filtering, my router has that flaw . Anyway like you say even mac address filtering will stop most people from connecting, besides if the intruder knows how to defeat that wep and wpa will not pose a big challenge too I guess.

tjwoosta · 2009-03-02 16:03:59

the most important thing you can do is to change the default username and password on your router (if you havnt already)

after changing the default username and password for your router you can move on to change your wireless username and password

(usually you would want two different usernames and passwords because if someone were to crack your wireless password, you wouldn't want them to have the routers password also )

also, if you are using unsecure wireless or even wep you will want to change it to at least wpa

if it is one of your neighbors that is borrowing your connection, and you left your routers username and password at default it would be very easy for him to just search online to find out what the default username and password are for your routers model

at that point he could change it himself and lock you out of your own bandwidth

check here to find out how to acess your routers settings
http://compnetworking.about.com/od/wifi … outers.htm

check here to see if you can find the defaut password for your router
http://www.phenoelit-us.org/dpl/dpl.html

also, if either one of those links fails to help you its very easy to find this stuff on google

Last edited by tjwoosta (2009-03-02 16:05:03)

R00KIE · 2009-03-02 17:15:50

at that point he could change it himself and lock you out of your own bandwidth

Until he does a reset that puts the router with the factory defaults that is (username and password included). On that side of things, if you can, allow only access to the router configuration through the wired network ports, that way unless the naughty neighbor breaks into your house he can't change anything
Mind you that this also applies to you, so you will have to be connected by cable to the router to be able to access its configuration.

Arch Linux

#1 2009-03-01 13:54:24

Introuders on my Internet?!

#2 2009-03-01 16:02:12

Re: Introuders on my Internet?!

#3 2009-03-01 16:54:56

Re: Introuders on my Internet?!

#4 2009-03-01 16:56:19

Re: Introuders on my Internet?!

#5 2009-03-01 18:04:11

Re: Introuders on my Internet?!

#6 2009-03-02 04:49:50

Re: Introuders on my Internet?!

#7 2009-03-02 09:28:21

Re: Introuders on my Internet?!

#8 2009-03-02 16:03:59

Re: Introuders on my Internet?!

#9 2009-03-02 17:15:50

Re: Introuders on my Internet?!

Board footer