Netstumbler "Vendor: Fake"

As the title states im connecting to a AP that reads "fake" as the vendor in netstumbler. The even more interesting thing is that i decided to do a tracert to google.com and i saw this:

Tracing route to google.com [216.239.37.99]
over a maximum of 30 hops:

1 3 ms 3 ms 3 ms 192.168.1.1
2 9 ms 9 ms 9 ms 10.102.96.1
3 220 ms 10 ms 11 ms atm3 *
4 11 ms 13 ms 19 ms *
5 10 ms 8 ms 9 ms *
6 15 ms 11 ms 11 ms *
7 32 ms 27 ms 35 ms *
8 41 ms 28 ms 27 ms * "These other IPs did show up i jus marked them out"
9 28 ms 27 ms 28 ms *
10 27 ms 27 ms 29 ms *
11 55 ms 48 ms 40 ms *
12 42 ms 45 ms 51 ms *
13 54 ms 43 ms 49 ms *
14 244 ms 42 ms 43 ms *
15 44 ms 43 ms 42 ms 216.239.37.99

The line of interest to me is ofcourse the second one.....a private IP address "after" the packet leaves the AP :confused: Some people have said that the fake vendor is nothing really but may a glitch in netstumbler or the way an AP might present itself but in this case it seems to b more...So does this mean that this AP is forwarding everything to a private network and then to it the internet from there?

Netstumbler might not have an updated mac/vendor list.
I see this often with the newer westel dsl modem/wireless access point combos.

You can manually look them up.
http://www.cavebear.com/CaveBear/Ethernet/vendor.html

There are several sites out there that have the mac/vendor list. I'm not sure which are kept up to day.

As far as your trace route... your ISP (or whoever setup that AP) could be NATing out your "WAN" ip address. This is done for a variety of reasons... they are short on IP addresses and NAT can solve that problem. They can filter the services you are allowed using NAT.

I do that on my home network.

WAN (public IP) <--> WAN port (Wired Router) LAN port <--> Private LAN Subnet 1
LAN (private IP) <--> WAN port (W/less Router) LAN port <--> Private LAN Subnet 2

I have the WAN port of the wireless router hooked into a switch port on the Private LAN that gets assigned a private IP address.

So, my wired and wireless clients are on separated via router/firewall on different subnets. I can limit what services the Wireless hosts can use.

In your traceroute from the AP, the first public IP address should be your "true gateway" address if you are being NAT'd.

A "whois" suggests the address belongs to IANA:

OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: 4676 Admiralty Way, Suite 330
City: Marina del Rey
StateProv: CA
PostalCode: 90292-6695
Country: US

NetRange: 10.0.0.0 - 10.255.255.255
CIDR: 10.0.0.0/8
NetName: RESERVED-10
NetHandle: NET-10-0-0-0-1
Parent:
NetType: IANA Special Use
NameServer: BLACKHOLE-1.IANA.ORG
NameServer: BLACKHOLE-2.IANA.ORG
Comment: This block is reserved for special purposes.
Comment: Please see RFC 1918 for additional information.
Comment:
RegDate:
Updated: 2002-09-12

OrgAbuseHandle: IANA-IP-ARIN
OrgAbuseName: Internet Corporation for Assigned Names and Number
OrgAbusePhone: +1-310-301-5820
OrgAbuseEmail: [email protected]

OrgTechHandle: IANA-IP-ARIN
OrgTechName: Internet Corporation for Assigned Names and Number
OrgTechPhone: +1-310-301-5820
OrgTechEmail: [email protected]

# ARIN WHOIS database, last updated 2005-07-05 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

If you are connecting from your workstation to the AP, that first IP is the internal address of the AP (the one you see from your system). The AP has an external IP that is probably assigned by the ISP (whoever that may be). The next IP is the internal IP of the next system downstream from you. That is the gateway provided by your ISP. Probably a firewall and you are seeing the internal IP. The next IP, 3, is the IP of the next router downstream from there, etc., etc.

Nothing weird or mysterious here.

Its not really possible for you to go from #1 your internal network of 192.168.x.x to #2 10.x.x.x unless you have some routing configured. I mean once it left your network how could a 10.x.x.x be handled on the internet. But it is very possible to have any internal network routed out through another internal network (ie the 10.x.x.x network).

Quote:

---

But it is very possible to have any internal network routed out through another internal network (ie the 10.x.x.x network).

---

Thats what I think is happening... but thats just by looking at part of a traceroute.

It could be the ISP that NAT'd out their addresses (happens quite often), or they could be using someone elses AP and doesn't know how it is setup.

Nihil: aren't all ip addresses "owned" by IANA? customers just "rent" them?

Any IP in these ranges will should show up with the same "whois".

10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255

Those IP addresses are the IPs that ANYONE can "own".
They can't be routed over the internet and are only for use on private networks.

Only one person can have any one public IP address... but anyone can have the private addresses that are listed above.

Do you know who/what the AP really is? My gut feeling is honeypot.

Phish~

Quote:

---

Nihil: aren't all ip addresses "owned" by IANA? customers just "rent" them?

---

Not exactly. IANA manage and allocate the addresses but they don't own them (I recall the UN were trying to take over a little while back?)

The blocks you refer to are reserved for special purposes, which makes it look odd to me, given where it shows up in traceroute?

:confused:

Quote:

---

Originally posted here by zENGER
Do you know who/what the AP really is? My gut feeling is honeypot.

---

I was thinking the same thing....this is just an AP in the neighborhood i jus moved too and i dont have internet just yet :D.....i guess it couldnt hurt to do alil investigating on my own....Ill get to practice using a few network tools and theories that we all read about :D

Erm, are you kidding me?Try a whois on 127.0.0.1. OMFG IANA owns my localhost!! lol, seriously they are RFC 1918, of course they are reserved. Does 192.168.x.x ring a bell? And of course the second hop is also a rfc1918 like the first, they are both internal networks. the 10.x.x.x (also rfc1918) is probably the wired network which gets NATed to the internet. On that wired network is a wireless AP, the wireless AP is gets its addy from 10.x.x.x DHCP and then runs its own DHCP on 192.168.x.x, this way the WLAN and LAN are separate. Its not a honeypot its some dude with a linksys AP plugged into his Linksys router.



-Maestr0

Quote:

---

Originally posted here by Maestr0
Erm, are you kidding me?Try a whois on 127.0.0.1. OMFG IANA owns my localhost!! lol, seriously they are RFC 1918, of course they are reserved. Does 192.168.x.x ring a bell? And of course the second hop is also a rfc1918 like the first, they are both internal networks. the 10.x.x.x (also rfc1918) is probably the wired network which gets NATed to the internet. On that wired network is a wireless AP, the wireless AP is gets its addy from 10.x.x.x DHCP and then runs its own DHCP on 192.168.x.x, this way the WLAN and LAN are separate. Its not a honeypot its some dude with a linksys AP plugged into his Linksys router.



-Maestr0

---

ah...that makes since...thnx for all the replies...o yea..and i ran port scan on the 10.x.x.x and the only port that was open was port 514 with a service called cmd :eek: running(reported by nmap). I tried to telnet to it see if it was the cmd from windows but all i got was a blank screen.

How about an AP with a spoofed MAC..

That would make it a Fake vendor ID..

Hi Maestr0 ,

Thanks, I had spotted the first one it was the second 10.x.x.x that had me confused. I didn't even think about wireless.................here in "log cabin country" we don't even have cable TV :D

Your explanation makes it all fit now:)