Two IP addresses or mysterious intruder?

[Guest]

Hi,

I was checking my routers attached devices and it reported back this:

# IP Address Device Name MAC Address
1 192.168.1.5 your-bb2022cae1 00:0e:35:89:0f:c6
2 192.168.1.3 Gogs 00:14:85:b1:ac:d6
3 192.168.1.4 kerry 00:11:50:77:32:7e

I've no idea what the one at 192.168.1.5 is!!! i've tried to ping it but it
doesn't respond and won't Tracert either. Our two house PCs are "Gogs" and
"Kerry". I ran IPCONFIG /all on my PC and got the following:

C:\Documents and Settings\Gogs>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : Gogs
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8139/810x Family Fast
Ethernet NIC
Physical Address. . . . . . . . . : 00-14-85-B1-AC-D6
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . :192.168.1.5
Subnet Mask . . . . . . . . . . . : 255.255.255.0
IP Address. . . . . . . . . . . . : 192.168.1.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.1

My PC appears to have two IP addresses but I only have one NIC (the wireless
adaptor is not enabled)?!??!?!

Is it possible that my PC could have 2 IP addresses? The MAC address and
Device name do not match to my PC. The details for "Kerry" are correct and
IPCONFIG on that PC only shows 1 IP address.

Any ideas?

Cheers Gogs

 

[Lanwench [MVP - Exchange]]

In

Hi,

I was checking my routers attached devices and it reported back this:

# IP Address Device Name MAC Address
1 192.168.1.5 your-bb2022cae1 00:0e:35:89:0f:c6
2 192.168.1.3 Gogs 00:14:85:b1:ac:d6
3 192.168.1.4 kerry 00:11:50:77:32:7e

I've no idea what the one at 192.168.1.5 is!!! i've tried to ping it
but it doesn't respond and won't Tracert either. Our two house PCs
are "Gogs" and "Kerry". I ran IPCONFIG /all on my PC and got the
following:

C:\Documents and Settings\Gogs>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : Gogs
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8139/810x Family Fast
Ethernet NIC
Physical Address. . . . . . . . . : 00-14-85-B1-AC-D6
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . :192.168.1.5
Subnet Mask . . . . . . . . . . . : 255.255.255.0
IP Address. . . . . . . . . . . . : 192.168.1.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.1

My PC appears to have two IP addresses but I only have one NIC (the
wireless adaptor is not enabled)?!??!?!

Is it possible that my PC could have 2 IP addresses? The MAC address
and Device name do not match to my PC. The details for "Kerry" are
correct and IPCONFIG on that PC only shows 1 IP address.

Any ideas?

Cheers Gogs

Do you use/have wireless networking?

 

[Chuck]

Hi,

I was checking my routers attached devices and it reported back this:

# IP Address Device Name MAC Address
1 192.168.1.5 your-bb2022cae1 00:0e:35:89:0f:c6
2 192.168.1.3 Gogs 00:14:85:b1:ac:d6
3 192.168.1.4 kerry 00:11:50:77:32:7e

I've no idea what the one at 192.168.1.5 is!!! i've tried to ping it but it
doesn't respond and won't Tracert either. Our two house PCs are "Gogs" and
"Kerry". I ran IPCONFIG /all on my PC and got the following:

C:\Documents and Settings\Gogs>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : Gogs
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8139/810x Family Fast
Ethernet NIC
Physical Address. . . . . . . . . : 00-14-85-B1-AC-D6
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . :192.168.1.5
Subnet Mask . . . . . . . . . . . : 255.255.255.0
IP Address. . . . . . . . . . . . : 192.168.1.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.1

My PC appears to have two IP addresses but I only have one NIC (the wireless
adaptor is not enabled)?!??!?!

Is it possible that my PC could have 2 IP addresses? The MAC address and
Device name do not match to my PC. The details for "Kerry" are correct and
IPCONFIG on that PC only shows 1 IP address.

Any ideas?

Cheers Gogs

Gogs,

Is this a wireless router? Do you practice WiFi Security?
<http://nitecruzr.blogspot.com/2005/05/setting-up-wifi-lan-please-protect.html>
http://nitecruzr.blogspot.com/2005/05/setting-up-wifi-lan-please-protect.html

Is your router WallWatcher compatible?
<http://www.wallwatcher.com/>
http://www.wallwatcher.com/

If you can use WallWatcher, or a similar router log display program, see if you
get any mysterious outgoing traffic. Find out if this mysterious host is active
now. Then improve your security, on all of your computers.
<http://nitecruzr.blogspot.com/2005/05/please-protect-yourself-layer-your.html>
http://nitecruzr.blogspot.com/2005/05/please-protect-yourself-layer-your.html

 

[Guest]

To answer both lots of questions.

It is a wireless router - one PC is attached by ethernet and the other is
connected by wireless.

I know I should have some security in place - I'm just a bit lazy.

I'm more curious as to whether the other PC could be mine as per IPCONFIG or
not.

As an interesting additional point I've restricted Wireless access to the 2
MAC addresses of my home PCs and I have not seen the "mysterious PC" reappear
as of yet

 

[Chuck]

To answer both lots of questions.

It is a wireless router - one PC is attached by ethernet and the other is
connected by wireless.

I know I should have some security in place - I'm just a bit lazy.

I'm more curious as to whether the other PC could be mine as per IPCONFIG or
not.

As an interesting additional point I've restricted Wireless access to the 2
MAC addresses of my home PCs and I have not seen the "mysterious PC" reappear
as of yet

Hi Gogs,

OK, if you have WiFi, it's most likely a neighbor or passerby who found your
exposed AP, most likely not you. Blocking access by MAC address is a start, but
most script kiddies now know how to bypass MAC address filtering. WEP (absolute
minimum) or WPA (with WPA2 better) is needed. Protect yourself.
<http://nitecruzr.blogspot.com/2005/05/setting-up-wifi-lan-please-protect.html>
http://nitecruzr.blogspot.com/2005/05/setting-up-wifi-lan-please-protect.html

And checking your logs, as you did, is an essential component in layered
security. So good start.
<http://nitecruzr.blogspot.com/2005/05/please-protect-yourself-layer-your.html#Layer5>
http://nitecruzr.blogspot.com/2005/05/please-protect-yourself-layer-your.html#Layer5