Newsgroup: it.comp.reti.locali
Titolo: router belkin w intrusi wi-fi

Salve a tutti.
Ho acquistato un router modem wifi della belkin, che mi ha ampliato la 
portata del segnale wireless.
Ho impostato il controllo dei mac-address facendo una lista dei mac 
fidati e autorizzare l' accesso esclusivamente a lor, NON ho impostato 
wep o wpa per scelta.
A causa di alcune disconnessioni e del fatto che mi sono ritrovato un 
intruso nel wireless, ho richiesto al negozio di sostituirmelo con un 
altro dello stesso modello.
Per qualche giorno le cose sono andate bene ma oggi ho ritrovato l' 
amico di cui sopra agganciato al mio segnale wireless.
Sottolineo che utilizza un suo indirizzo mac, diverso da quelli 
autorizzati, e si connette al dhcp.
Il nome del client che si connette  e' "utente-*"  dove con l' asterisco 
indico una stringa di otto cifre esadecimali che ovviamente ho salvato, 
cosi' come ho salvato l' indirizzo MAC.
Tra l'altro il log del router ecco cosa riporta (192.168.1.3 e' l' ip 
del mio pc, colelgato via cavo con indirizzo ip statico, 192.168.1.101 
e' l' ip suo, con dhcp):
System Log
02/21/2010  02:18:38 192.168.1.3 login success
02/21/2010  02:17:21 sending ACK to 192.168.1.101
Firewall Log
02/21/2010  02:16:05 **Ping of Death/Tear Drop** 88.30.124.95, 48255->> 
192.168.1.101, 9997 (from PPPoE1 Inbound)
02/21/2010  02:02:20 sending ACK to 192.168.1.101
02/21/2010  01:59:42 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 15629 (from PPPoE1 Inbound)
02/21/2010  01:59:31 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 15629 (from PPPoE1 Inbound)
02/21/2010  01:59:21 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 15629 (from PPPoE1 Inbound)
02/21/2010  01:58:05 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:58:00 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:57:54 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:57:49 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:57:42 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:57:36 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:57:30 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:57:25 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:57:14 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:57:03 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:56:57 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:56:43 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:56:33 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:56:27 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:56:15 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:56:07 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:56:01 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:55:47 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:55:42 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:55:36 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:55:28 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:55:21 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:55:15 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:55:06 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:54:55 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:54:50 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:54:43 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:54:38 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:54:32 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:54:26 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 11882 (from PPPoE1 Inbound)
02/21/2010  01:53:08 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:53:03 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:52:57 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:52:52 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:52:46 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:52:39 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:52:28 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:52:22 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:52:17 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:52:11 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:52:06 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:51:49 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:51:44 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:51:39 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:51:34 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:51:28 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:51:22 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:51:16 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:51:05 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:50:55 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:50:50 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:50:31 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
02/21/2010  01:50:26 **Ping of Death/Tear Drop** 91.90.78.28, 59975->> 
192.168.1.101, 19206 (from PPPoE1 Inbound)
Secondo voi e' un hacker che si diverte o e' uno che riesce a entrare 
per delle falle del router (oggi e' stato scolelgato dalal corrente due 
volte e magari non e' ripartito bene...) e sta subendo degli attacchi?
C'e' modo di capire chi e' il simpaticone, in entrambi i casi?
E che tipo di iniziative di possono intraprendere? (a parte mettere 
chiavi wep o wpa....).
Grazie.

 autorizzati, e si connette al dhcp.
non dovrebbe essere possibile, a meno che in configurazione ci sia qualche 
altra impostazione necessaria, oltre
all'elenco dei MAC ammessi.
Se non e' un problema di configurazione, allora evidentemente il router non 
funziona e va cambiato.
In ambito di sicurezza aziendale, la protezione mac non e' considerata 
troppo sicura, e
neppure la wep.
Il problema e' che la wpa richiede un  hardware piu' potente e, sui vecchi 
router, si
notava un rallentamento vistoso rispetto alla wep.
Se il tuo router non ha questo problema, dovresti impostare la  wpa.
ciao
fm
.

 
Condivido questa analisi.
Tuttavia non e' possibile che se uno imposta una lista di MAC fidati, 
essa non venga rispettata dal router, e cosi' come non e' accettabile 
che se si seleziona la modalita' wifi in OFF tale cosa non abbia 
conseguenze nel router, che non solo lascia il wifi attivo ma 
addirittura non accende il led in caso di connessioni effettuate.
Rimane il fatto che mi piacerebbe capire chi e' questo che mi entra 
nella rete, o anche sapere che tipo di traffico effettua: qualcuno 
conosce qualche metodo/software in proposito?

 qualche metodo/software in proposito?
Con indirizzo IP, data e ora, presso il provider internet si risale  al 
"proprietario" dell'IP in quel momento.
Pero', per ovvie ragioni,  queste informazioni non sono disponibili per il 
pubblico. Solo, eventualmente, per le FdO.
Esistono una quantit� di strumenti software per l'analisi della rete, alcuni 
molto sofisticati, quindi quello che chiedi e' teoricamente fattibile, temo 
pero' che il gioco non valga la candela....:-)
ciao
fm
 

 Grazie.
Ciao, Antï¿œ.