ok, everyone make fun of me now

My home network is small, about 6 or 7 people use it, we all split the cost. I started noticing strange lag on my pc. It was interfering with my mmo, so naturally it was a priority issue. Picture alarms, flashing lights, and screaming coming from a loud speaker. I first check my pc's firewall log for any thing weird, and low and behold, there is. Im getting dropped connections from an ip on my network that has no reason to connect to my pc. So I check the connected devices list and nothing too unusual, all the regulars and the new guy. hmmm.
Now i did mention this issue has top priority right? :) I decide to block the port from connecting to my pc at the router thats generating the traffic. This should solve the issue, but no, port scanns start, same ip, but the subnet has changed. Now Im thinking the new guy on the network is up to something shifty. Now I have to make some changes on my pc to capture traffic in promiscious mode since im conneting via wireless. Im just about ready to bridge my 1394 connection with my wireless connection so ethereal can grab traffic (i dont know why this works), before I do I want to check the routers connected devices list to make sure of the mac addresses im going to filter.
Newguy's ip address isnt the one generating traffic, its the @#$@#$!!! new network printer.
I had to laugh at my self. You can laugh at me too if you want, the $%$% funny.

So...bridging your 1394 connection with your wireless on will let Ethereal capture wireless traffic...... 802.11 traffic??? :confused: :eek:

nope, it doesnt capture traffic of a network im not connected to already, just the stuff thats on my network. It does allow ethereal to capture promiscus(how ever its spelled) over my wireless connection though, which without the bridging it will not.

I don't follow you buddy - it captures in promiscuous mode...but only on your network?

yes. a lot of 802.11 cards do not support promiscuous capture, or etereal does not support a lot of network cards, how ever you want to look at it. To be honest Im not sure why it works. but after I bridge the two, when i open ethereal I can select the mac miniport adapter to capture from. This captures traffic from all devices on the network. I wasnt meaning promiscuous, as in kismet promiscuous.

The bridge can be used with other software as well, instead of having a cable run to my station, all I have to do is make the bridge and reboot. I know its a cheap and unprofessonal way to capture traffic, but hey, its my home network. I prefer this over using cain or ettercap since there is not a man in the middle needed to see what going through the wire.

And I still say its weird that my printer port scanned me.

Cant laugh at you but will laugh with you had something sim happen to be while running a small network

"Back in the day"(tm)

I used to do initial forensics and network security for some 'interesting' networks. One time I got a call from a network admin telling me they had a cracked machine but they couldn't figure out the attack, apparently, the attack was from an insider, and they were still trying to track down who the IP belonged to.

I flew to the site, started my investigation (after much remote investigation to make sure I wasn't flying for stupidity), and to make a long story short, we found out that an external machine had popped a network printer and then had used the network printer to pop other machines.

Moral: Just because it's a printer, don't disregard it. It has an OS, Harddrive, and network capabilities too.

Quote:

---

And I still say its weird that my printer port scanned me.

---

It is weird. I wouldn't disregard it, especially with an active person you don't know on the network. Granted it's wireless so that's going to happen. I would restore that printer to factory default then turn off SNMP, change the password etc. Since this guy or gal was connected its possible there are some modifications to your pcs, devices and those of the others you allow on the network. And anyone of them could have comprimised your security key.

The reason bridging works is because you wireless card isn't communicating with other cards. It's communicating with the router, or access point. You will only see packets destined to your mac address associated with your IP and your wireless device. This keep the overhead on the wirless channel low. When you bridge a device you are essentially saying everything coming through here goes to every thing on this network.

Even then depending on software support every packer may or may not get captured.

//EDIT oh and the printer may have just been responding to normal network enquiries too. When you say scan you mean multiple ports? Windows will poll printers for status and they will respond.

Supporting what KCORE and ROADCLOSED Said:

Quote:

---

Just because it's a printer, don't disregard it. It has an OS, Harddrive, and network capabilities too.

---

Quote:

---

I wouldn't disregard it, especially with an active person you don't know on the network.

---

Check out Irongeeks presentation at Notacon2006 on hacking network printers HERE