Is this an attack in Wireless Security http://www.dslreports.com/forum/r19881448 en Sun, 20 Jul 2008 05:11:55 EDT Sun, 20 Jul 2008 05:11:55 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,20367538 Da_Penguin : It's also quite trivial to spoof a MAC (windows will actually check the registry for a MAC address of the network card, before using the card's built in one so its just a registry key change)

but as it has been said earlier it this thread, since it is only Deny's showing, i wouldn't be concerned.]]> http://www.dslreports.com/forum/remark,20367538 Tue, 22 Apr 2008 10:08:57 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,20060540 Thane_Bitter :
said by gregandrene See Profile :

N00b question: how do you register MAC addresses? Aren't they hardwired in the NIC?
The IEEE assigns MAC addresses to hardware makers (actually large blocks of addresses), you can use a tool on their site to see who made the device.

»standards.ieee.org/regauth/oui/index.shtml
Use the "Search the public OUI listing" box and enter the fist 6 hex digits of the MAC address.
--
...A bitter ray of sunshine]]> http://www.dslreports.com/forum/remark,20060540 Mon, 25 Feb 2008 18:24:56 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,20029512 circle : What you are seeing is most likely normal behavior from a neighbor or other nearby user.

One of my systems is near a road that is traveled by service vehicles that use Wi-Fi. Their systems attempt to associate with mine as they go by. They can’t due to encryption so the logs show denied.
--
There's no place like 127.0.0.1]]> http://www.dslreports.com/forum/remark,20029512 Wed, 20 Feb 2008 10:39:37 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,20029498 Anav : No good reason to turn essid off and it may cause you reconnecting issues. Best to leave it off. Mac filtering has no possible negative effects, thus can be left in place although security wise its not very effective. (curious if you remove mac filtering what happens ref the logging), ]]> http://www.dslreports.com/forum/remark,20029498 Wed, 20 Feb 2008 10:38:24 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,20028039 gregandrene :
said by darthboy See Profile :

»standards.ieee.org/cgi-bin/ouise···00-0D-3A

I did a search for that MAC address. The MAC address is registered to Microsoft. You sure you not running Virtual PC/Server?
N00b question: how do you register MAC addresses? Aren't they hardwired in the NIC?]]> http://www.dslreports.com/forum/remark,20028039 Wed, 20 Feb 2008 00:24:08 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,19883489 nwrickert :
Do these "attacks" slow down your router while it handles them?
Not significantly. They are only a tiny fraction of the traffic, so you would not notice the effect.

Additionally, since they are local, they don't impact your bandwidth to your ISP and to the internet.
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.10]]> http://www.dslreports.com/forum/remark,19883489 Sun, 27 Jan 2008 13:19:01 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,19883417 JDErickson :
said by WLiley See Profile :

as has been said, with WPA2 you are ok.
the MAC filtering & disabled SSID broadcast does little/nothing (as you may have discovered).

seeing things hit your log is not cause for alarm.
as long as you see "access denied" like you have.

you should see the hits my router takes!
(WallWatcher & NetWatchman used here) :D
Do these "attacks" slow down your router while it handles them?]]> http://www.dslreports.com/forum/remark,19883417 Sun, 27 Jan 2008 13:04:34 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,19883410 JDErickson :
said by darthboy See Profile :

»standards.ieee.org/cgi-bin/ouise···00-0D-3A

I did a search for that MAC address. The MAC address is registered to Microsoft. You sure you not running Virtual PC/Server?
No.

I checked my Logs today and nothing out of the ordinary.]]> http://www.dslreports.com/forum/remark,19883410 Sun, 27 Jan 2008 13:02:53 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,19882146 darthboy : »standards.ieee.org/cgi-bin/ouise···00-0D-3A

I did a search for that MAC address. The MAC address is registered to Microsoft. You sure you not running Virtual PC/Server?]]> http://www.dslreports.com/forum/remark,19882146 Sun, 27 Jan 2008 03:11:19 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,19882138 WLiley : as has been said, with WPA2 you are ok.
the MAC filtering & disabled SSID broadcast does little/nothing (as you may have discovered).

seeing things hit your log is not cause for alarm.
as long as you see "access denied" like you have.

you should see the hits my router takes!
(WallWatcher & NetWatchman used here) :D
--


"The Edge... there is no honest way to explain it because the only people who really know where it is are the ones who have gone over." HST
]]> http://www.dslreports.com/forum/remark,19882138 Sun, 27 Jan 2008 03:04:39 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,19882103 darthboy : are you running VMware/VPC or any virtualization software?]]> http://www.dslreports.com/forum/remark,19882103 Sun, 27 Jan 2008 02:58:07 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,19881664 nwrickert : It might well have been an attack. But still no reason for concern, as long as you have a strong WPA2 key.]]> http://www.dslreports.com/forum/remark,19881664 Sun, 27 Jan 2008 00:15:58 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,19881589 JDErickson :
said by nwrickert See Profile :

You are using WPA2. So nothing to worry about, unless you are using a weak key.

It could be an attack. Or it could be a neighbor mistakenly connecting to the wrong network.
What concerned me was I have SSID off and the sequence of the MAC addresses. ]]> http://www.dslreports.com/forum/remark,19881589 Sat, 26 Jan 2008 23:57:18 EDT Re: Is this an attack http://www.dslreports.com/forum/remark,19881556 nwrickert : You are using WPA2. So nothing to worry about, unless you are using a weak key.

It could be an attack. Or it could be a neighbor mistakenly connecting to the wrong network.
--
AT&T dsl; Westell 2200 modem/router; SuSE 10.1; firefox 2.0.0.10]]> http://www.dslreports.com/forum/remark,19881556 Sat, 26 Jan 2008 23:49:01 EDT Is this an attack http://www.dslreports.com/forum/remark,19881448 JDErickson : Hello all,
I have a Dlink DIR-655 with WPA2, DHCP off, Mac address filtering and SSID off.

Today I see this in my log:

Sat Jan 26 14:45:44 2008 Access denied to LAN system with MAC address 000D3AE88806
[INFO] Sat Jan 26 14:45:40 2008 Above message repeated 23 times
[INFO] Sat Jan 26 14:45:40 2008 Access denied to LAN system with MAC address 000D3AE88803
[INFO] Sat Jan 26 14:45:40 2008 Access denied to LAN system with MAC address 000D3AE88801
[INFO] Sat Jan 26 14:45:40 2008 Above message repeated 2 times
[INFO] Sat Jan 26 14:45:40 2008 Access denied to LAN system with MAC address 000D3AE88800
[INFO] Sat Jan 26 14:45:03 2008 Access denied to LAN system with MAC address 000D3AE88706
[INFO] Sat Jan 26 14:45:00 2008 Above message repeated 23 times
[INFO] Sat Jan 26 14:45:00 2008 Access denied to LAN system with MAC address 000D3AE88703
[INFO] Sat Jan 26 14:45:00 2008 Access denied to LAN system with MAC address 000D3AE88701
[INFO] Sat Jan 26 14:45:00 2008 Above message repeated 2 times
[INFO] Sat Jan 26 14:45:00 2008 Access denied to LAN system with MAC address 000D3AE88700
[INFO] Sat Jan 26 14:44:15 2008 Access denied to LAN system with MAC address 000D3AE88606
[INFO] Sat Jan 26 14:44:14 2008 Above message repeated 5 times
[INFO] Sat Jan 26 14:44:14 2008 Access denied to LAN system with MAC address 000D3AE88603
[INFO] Sat Jan 26 14:44:14 2008 Access denied to LAN system with MAC address 000D3AE88601
[INFO] Sat Jan 26 14:44:14 2008 Above message repeated 2 times
[INFO] Sat Jan 26 14:44:14 2008 Access denied to LAN system with MAC address 000D3AE88600

None of these MACs are mine.
Is this an attack? If so can I do anything?]]> http://www.dslreports.com/forum/remark,19881448 Sat, 26 Jan 2008 23:23:56 EDT