bugtraq - Re: Tool for Identifying Rogue Linksys Routers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20050826133145.GA2825@w4g.org>
Date: Fri, 26 Aug 2005 09:31:45 -0400
From: Mike Frantzen <frantzen@....com>
To: Martin Mkrtchian <dotsecure@...il.com>
Cc: Bugtraq <bugtraq@...urityfocus.com>,
	"Full-Disclosure (E-mail)" <full-disclosure@...ts.netsys.com>
Subject: Re: Tool for Identifying Rogue Linksys Routers



> Is there a scanning tool out there that can determine if there are
> unauthorized Linksys (type) routers in a specific VLAN?
 
All linksys MACs will have an address with one of these prefixes:
        00045A       The Linksys Group,
        000625       The Linksys Group, In
        000C41       The Linksys Group, In
        000F66       Cisco-Linksys
        001217       Cisco-Linksys, LLC
        001310       Cisco-Linksys, LLC
e.g.
        00:04:5A:xx:xx:xx


Plug a laptop into any worrisome network segments and look for a linksys
MAC address. If the linksys routers talk IPv6:
        ping6 -w ff02:1%fxp0    (or %eth0 or whatever your interface is)
Otherwise do a broadcast ping, a ping sweep, or whatever will tickle a
linksys router.

(friendly reminder: the host's MAC address will not be preserved if the
packet goes through a router)

.mike
frantzen@(nfr.com | cvs.openbsd.org | w4g.org)
PGP:  CC A4 E2 E8 0C F8 42 F0  BC 26 85 5B 6F 9E ED 28