Printable View
What kind or device is this? Router? Switch? What? What's it's purpose on the network? Is it actually functional or is it "dead" equipment that never got removed? What are the subnets you do know?
That might help in determining an "attack" vector....
I know... I feel like we're playing "go fish"...Quote:
That might help in determining an "attack" vector....
The device is off the network segment and I am plugged into it (a wireless IP router by the way) and can sniff raw data using ethereal but all I get (and the only thing I get) is multiple spanning tree algorithm packets with no IP in the header or data fields. I did the ethereal sniffing at client site, now the box is at my office. (havent had time to look at it yet, but soon I will)Quote:
Originally posted here by phishphreek80
Can you take the device off of its current network segment? Place it on a hub with only your sniffer attached to it. Then just wait for some type of traffic or broadcast? Then you can get ip or mac? Possibly more info?
I'm assuming that you have physical access to it because you say banging it on a desk....
Maybe just plug that device into a hub then back to the switch.
Then you can watch all traffic going to that device. That will surely show you IP and MAC.
You can use ettercap to scan the subnet using arp. Then that box should reply with its IP address... But... if you don't know WHICH subnet... then you're SOL. Which is what you want. So.. that won't work.
I think putting a hub between that and other hosts and sniffing the traffic would be the best way.
It's not responding to arp packets and I have no assurance of it's IP as it's not responding to IP scans.
banging it on a desk was merely a last resort joke, as in "hit it with a bigger hammer."
Still, I'm still looking for that magical software that allows me to be on, say 192.168.2.x and scan for IP's (or MAC's) on any OTHER unknown subnet range without forcing me to change my IP configuration.
Robakam, I have and use Airsnare, but it's just a basic logger.
I will look into tcpnetview to see if it's better than my other network scanning software.
TS, It's a wireless router, as you already know. It was functional for over a year before I got the call to come find out why network access off this device is not working.
It was on a 192.168.1.0 subnet.Quote:
What are the subnets you do know?
Actually there are two wireless routers with this problem, although the "one' router resolved itself after a 45 minute poweroff rest and has been working in my office overnight. The "other" router I will look into after I come back from an appointment with a client.
Well if there is No info on the net...no vendor support..you dont have manuals...why would you want the device on your network???
Toss it!
Buy a new one??
...maybe I am not understanding the point here :confused:
MLF
I'm inclined to agree with Morgan....
This device seems to be totally non-standard and, depending upon the frequencies used may actually not be FCC approved any more and thus might cause other trouble. If you know the task these two devices were intended to perform is it possible to substitute them for something more *cough* mainstream"?
I know it was a joke. ;) But from that joke I guessed that you had physical access to the device.Quote:
banging it on a desk was merely a last resort joke, as in "hit it with a bigger hammer."
I'm unable to find software that will do this too. I'd think that it'd take WAY too long to scan all unknown subnets... Not only that... but now you'd be possibly scanning out onto the internet and other people's networks and not your own. If someone didn't know what they are doing and did this... there would be a lot of pissed off network/firewall admins out there.Quote:
Still, I'm still looking for that magical software that allows me to be on, say 192.168.2.x and scan for IP's (or MAC's) on any OTHER unknown subnet range without forcing me to change my IP configuration.
I even tried setting my ip to dhcp so no ip was assigned. Then I unbind IP from my network interface. The tool I tested with was ettercap. It pulled my last known IP address and scanned that subnet.
I rebooted and it saw that my ip was 0.0.0.0 with a subnet of 255.0.0.0 and it wouldn't scan anything. Ethereal showed no traffic being generated from ettercap.
Thanks Phishy for trying it using ettercap without a bound IP on your adapter.
In answer to your other question Phishy, the software I'm looking for won't need to scan ALL unknown subnets, just a user selectable range of private IP addresses on a device I suspect is NOT addressed properly while on the same physical wire. I know this goes against the RFC but it would allow any addressed IP host machine to find ALL client IP machines regardless if they are properly addressed.
Sample fictional scenario:
I walk into an unknown network, as usual. The client complains that a program on their network is not working at all, since last night. I examine the program finding a client application that can't find it's server counterpart. Also there is a mapped drive that no longer exists. Instead of examining server share rights, logon names, proper syntax, proper shortcut redirection, blah....blah...blah, I notice a router between the client and the server, and a brief glance shows the router lights seem to be working.
The first option, after talking to those people involved, is to grab it's IP and get into the routers configuration page. So out comes the network cabling while I aim my overpowered notebook towards the proper network settings and give it a scan.
A IP scan of the network shows 6 working devices, but no router. A MAC scan gives 6 working devices, but nothing resembling a router.
Look at the router and ...Oh..it's one of those new ones or obscure ones or one that I have no current documentation on. All faceplate lights on the router blink in a bootup sequence that would show proper self check and subsequent operation but don't blink when data is being routed.
Repowering the router (over and over) doesn't do anything different.
I can take a chance at factory resetting the device, but some devices can only be reset while holding the reset button in when powering on, or it could be hold the reset button in for 15 seconds, then power off...or it could be....blah...blah..blah.. Make the wrong move and you can eat a router and I'm not that hungry.
What I need about now is a multi-threaded program that can scan all user defined IP addresses, even outside the current subnet range. Even if the router gave a MAC address I still don't have an IP address to telnet or http: into.
I don't want to spend 45 minutes scanning 10.0.1.x, 10.0.2.x, 10.0.3.x, and/or 172.16.0.x, 17.16.1.x (and I haven't even got close to 192.168.x.x, which is where I'd start first anyways, depending on the size of the network), etc...etc...
So here's the bottom line in this scenario:
Seems an inhouse network guy, who is off today, had a perceived router problem last night and factory reset the router using proper reset procedure for that router. But since he was off today, he left the clean up job (resetting up the router parameters) to his compadres on the morning shift (course he won't admit to that). So router was on a 192.168.x.x subnet but since the factory reset reverted to a 10.15.2.x (whatever!). It's now my job to find out why the application doesn't work, but instead I see the bigger problem. Using a scanner I want to find the IP address without spending ALL day long. Sure I make more money to a point, at which point the client starts seriously deciding on calling someone else and I lose the client forever.
Hopefully this is clear now and you can re-read my original post for the details.
This may work for you.
Correct me if I'm wrong but doesn't ethereal in promiscuous mode show all packet regardless of subnet? In that case, hook up your laptop with a cross-over cable directly to the rj-45 port of the router and then power cycle it. When it comes on it will most likely send out some packets onto the network and you'll be able to catch those.
zENGER,
I seriously don't want to scare people off of helping, since my last post said "sample fictional scenario". I actually have a copy of that sample fictional scenario device in my office right now.Quote:
The device is off the network segment and I am plugged into it (a wireless IP router by the way) and can sniff raw data using ethereal but all I get (and the only thing I get) is multiple spanning tree algorithm packets with no IP in the header or data fields. I did the ethereal sniffing at client site, now the box is at my office.
Since I'm a roving Consultant, I seem to get the sh** jobs no one else can figure out. Lucky me! (actually I love it).
Soon I'm going to startup the wireless router again and see what ethereal shows. After putzing with it a bit, I'm going to offer Gore or Tigershark or anyone else close enough to my location a few get acquainted beers and let them play with it, just for kicks.
What if you were to bring in another router... say a Cisco and add those networks/subnets. The 800 series are inexpensive ($250-500) and you can have multiple networks connected to it since it has multiple ethernet interfaces. (I use a 831 broadband router and a 806... 831 is the better of the two.)
Then you can route your scan through the router. Then you don't have to reconfigure the interface of the machine you're scanning from. Only the router config. ;)
You could also use another laptop if you wanted to... just configured like a router.
But... you are limited on interfaces and the laptop will cost more than the 800 series Cisco.
I know this isn't want you want... but I'm thinking up ideas.
BTW: How "Northeast" are ya? I'm right in the middle... close to Philly.
BTW: Have you ever tried out the solarwinds engineer edition. IIRC, you can tell what subnets you want to scan... but you have to have a route. Great suite of toolz. Expensive... but great. Let me know if you like them... I may have something else for you. ;)
http://www.solarwinds.net/Tools/Engineer/