Bugtraq mailing list archives
Re: Tool for Identifying Rogue Linksys Routers
From: Mike Frantzen <frantzen () nfr com>
Date: Fri, 26 Aug 2005 09:31:45 -0400
Is there a scanning tool out there that can determine if there are unauthorized Linksys (type) routers in a specific VLAN?
All linksys MACs will have an address with one of these prefixes: 00045A The Linksys Group, 000625 The Linksys Group, In 000C41 The Linksys Group, In 000F66 Cisco-Linksys 001217 Cisco-Linksys, LLC 001310 Cisco-Linksys, LLC e.g. 00:04:5A:xx:xx:xx Plug a laptop into any worrisome network segments and look for a linksys MAC address. If the linksys routers talk IPv6: ping6 -w ff02:1%fxp0 (or %eth0 or whatever your interface is) Otherwise do a broadcast ping, a ping sweep, or whatever will tickle a linksys router. (friendly reminder: the host's MAC address will not be preserved if the packet goes through a router) .mike frantzen@(nfr.com | cvs.openbsd.org | w4g.org) PGP: CC A4 E2 E8 0C F8 42 F0 BC 26 85 5B 6F 9E ED 28
Current thread:
- Tool for Identifying Rogue Linksys Routers Martin Mkrtchian (Aug 25)
- Re: Tool for Identifying Rogue Linksys Routers Mike Frantzen (Aug 26)
- Re: Tool for Identifying Rogue Linksys Routers Joshua Wright (Aug 26)
- Re: Tool for Identifying Rogue Linksys Routers Graham Wilson (Aug 26)
- Re: Tool for Identifying Rogue Linksys Routers Volker Tanger (Aug 27)
- Re: Tool for Identifying Rogue Linksys Routers Mike Kershaw (Aug 27)
- Re: Tool for Identifying Rogue Linksys Routers Dave Hull (Aug 26)
- Re: Tool for Identifying Rogue Linksys Routers Tony Rall (Aug 27)
- <Possible follow-ups>
- RE: Tool for Identifying Rogue Linksys Routers Thomas Guyot-Sionnest (Aug 26)
- RE: Tool for Identifying Rogue Linksys Routers Matt Mercer (Aug 26)
- Re: Tool for Identifying Rogue Linksys Routers Paul Halliday (Aug 27)