Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Unknown client popped up last night

    Firewalling
    3
    4
    743
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • 2
      2chemlud Banned last edited by

      Hi everybody!

      Strange event:

      I have here a 10.0.0.0/26, no wireless, just plain RJ45 cabel connections to clients. pfSense is 10.0.0.1. OK.

      This morning I found in the firewall log for this pfSense (10.0.0.1) strange UDP packages logged for an absolutely unknown client with the IP 192.169.11.150. Starting in the middle of the night (see attached).

      I have never ever used any IPs in this range nor has anybody been connected in the middle of the night to my network.

      The logging continues up to now, so I guess the client must be still out there. But I can't ping this client.

      What is going on here? I have no idea what is happening here…

      Any suggestions on how to find this ghost or anything helpful?

      Kind regards

      chemlud

      1 Reply Last reply Reply Quote 0
      • D
        doktornotor Banned last edited by

        Very much doubt it's a ghost. Someone connected a Windows machine with static IP set up to the network. Standard NetBIOS noise.

        1 Reply Last reply Reply Quote 0
        • johnpoz
          johnpoz LAYER 8 Global Moderator last edited by

          Well you can do a simple sniff on the interface via diag, packet capture and get the mac real easy.  You could also look into the packets its quite possible its handing out its name that might give you a clue.  From the mac its coming from you can look up what type of hardware it is.

          Depending on your switches you can track the mac to specific port, if you have smart/managed switch, etc.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 22.05 | Lab VMs CE 2.6, 2.7

          1 Reply Last reply Reply Quote 0
          • 2
            2chemlud Banned last edited by

            Yeah, apparently the Buffalo Linkstation went crazy last night. 192.168.11.150 is the default IP for these devices (I learned now from Google)… I rebooted the device now (as it was unreachable...) and the spook is over, as it looks now.

            Strange indeed if something like that starts in the middle of the night..

            1 Reply Last reply Reply Quote 0
            • First post
              Last post