GN-AP01G skanuje mi siec

Thread View: alt.pl.wirelesslan

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by n-o-e Fri, 28 Sep 2007 19:35

#41300

Author: n-o-e
Date: Fri, 28 Sep 2007 19:35

68 lines
3801 bytes

Witam,
mam problem, z AP-ekiem GN-AP01G 54Mbps AirCruiser G Access Point
Gigabyta.
Na wstępie prosze nie udzielac odpowiedzi RTFM i "google odpowie".
Sprawdzałem i odpowiedzi nie znalazlem.
Otóż lacze tego AP w WDS-ie z Tonziakiem na 2.4GHz. Wszystko dziala
cycuś glancuś, ale rutynowa kontrola ruchu sieciowego wykazala cos
ciekawego:

root@SG:/# tcpdump -ln -i eth1 'host 85.14.100.190'
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
21:20:32.982450 IP 85.14.100.190 > 85.14.103.187: icmp 36:
85.14.103.255 udp port 35072 unreachable
21:20:33.011286 IP 85.14.100.190 > 85.14.103.187: icmp 36:
85.14.103.255 udp port 35072 unreachable
21:20:33.047653 IP 85.14.100.190 > 85.14.102.234: icmp 36:
85.14.102.255 udp port 35072 unreachable
21:20:33.716489 IP 85.14.100.190 > 85.14.103.187: icmp 36:
85.14.103.255 udp port 35072 unreachable
21:20:33.757228 IP 85.14.100.190 > 85.14.102.177: icmp 36:
85.14.102.255 udp port 35328 unreachable



Wyglada na skanowanie sieci . Pomyslalem sobie ktos sie pod niego
podszywa.
Wiec sprawdzam jego mac ( dla pewnosci spisalem go z urzadzenia a nie
za pomoca arp ) i mam 00:16:E6:3A:6F:52.
Robie:

root@SG:/# tcpdump -i eth1 'host 85.14.100.190' -ln -e
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
21:27:01.558905 00:16:e6:3a:6f:54 > 00:30:4f:3b:1b:bf, ethertype IPv4
(0x0800), length 70: IP 85.14.100.190 > 85.14.102.101: icmp 36:
85.14.102.255 udp port 35328 unreachable
21:27:01.559014 00:30:4f:3b:1b:bf > 00:e0:4c:32:26:59, ethertype IPv4
(0x0800), length 70: IP 85.14.100.190 > 85.14.102.101: icmp 36:
85.14.102.255 udp port 35328 unreachable
21:27:04.851755 00:16:e6:3a:6f:54 > 00:30:4f:3b:1b:bf, ethertype IPv4
(0x0800), length 70: IP 85.14.100.190 > 85.14.101.226: icmp 36:
85.14.101.255 udp port 35072 unreachable
21:27:04.853095 00:30:4f:3b:1b:bf > 00:0b:6a:ee:8c:86, ethertype IPv4
(0x0800), length 70: IP 85.14.100.190 > 85.14.101.226: icmp 36:
85.14.101.255 udp port 35072 unreachable
21:27:05.608356 00:16:e6:3a:6f:54 > 00:30:4f:3b:1b:bf, ethertype IPv4
(0x0800), length 70: IP 85.14.100.190 > 85.14.101.226: icmp 36:
85.14.101.255 udp port 35072 unreachable

Gdzie 00:30:4f:3b:1b:bf to mac sieciowki na routerze ktory jest dla
tego AP bramą.

Skoro maki sie zgadzaja to wiadomo ze raczej nie mowy o podszyciu
( jakby ktos sie podszywal to albo bylby inny MAC albo nie daloby sie
wejsc na AP ).

Pytania brzmią:
1) What tha fuck is going on ?
2) Why ?
3) Jak to wyłączyc ?

Wersja softu to: 1.10E


pzdr. Armando

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads