Does any one recognize this log in screen? Pic

[Torghn]

Pic

It's someone or something that is connecting to my wireless network. I'm not trying to do anything, just what to know who/what it is. Does anyone recognize this at all? They connect with 3 private IP address, two of them have port 23 open. IIRC port 23 is only used for telnet, and this is what comes up when I telnet into them.

 

[sharq]

Nice, someone has a server setup on your connection. I have no idea what that login screen is for.
I would say though that you should change your WEP key, or if you don't have it enabled, this would be a good time to do that. Change the SSID too.

 

[Kadarin]

Originally posted by: sharq
Nice, someone has a server setup on your connection. I have no idea what that login screen is for.
I would say though that you should change your WEP key, or if you don't have it enabled, this would be a good time to do that. Change the SSID too.

And.. If you only have a couple of machines on your network, you may consider disabling dhcp and just giving your machines static ip addresses.

 

[sharq]

You could also use a tool like ethereal to monitor the packets. Since it's a telnet server, then anyone who connects to it will be doing so in clear text, meaning no encryption between client and server. Hell, it is your network, I don't think it is illegal to monitor your own network.

 

[Torghn]

Originally posted by: sharq
You could also use a tool like ethereal to monitor the packets. Since it's a telnet server, then anyone who connects to it will be doing so in clear text, meaning no encryption between client and server. Hell, it is your network, I don't think it is illegal to monitor your own network.

Thanks for the suggestion, I'll give it a try. I know exactly how to lock down my network, I'm just curious as to who they are. Any time I unlock my network they connect instantly. Most of my neighbors seem like people who wouldn't even know what wifi is.

 

[Darthkim]

The screen looks very familiar of a cisco login screen with a custom MOTD. Maybe its is a wireless AP in bridge mode. Hope this helps.

 

[eigen]

Be a little bit proactive use nmap to map them out, find out what there running so forth. Secifically you can use the -O flag to try and pinpoint the OS. Assuming they are just run of the mill script kiddies they prolly are not disguising the server.

 

[Boscoh]

I havent seen anyone mention the Rambo methodology.

This is wireless right? Which means they are probably somewhere in your general vicinity. Just take a fully loaded semi-automatic weapon and start kicking in doors until someone fesses up.

When you see this server connected, do you ever notice any strange cars outside your home? Perhaps with the windows REALLY tinted....

 

[AFB]

I agree, Rambo all the way.