Search:  

 
 
   All ForumsHot TopicsGallery






how-to block ads


 
Forums » Up and Running » Security » Wireless Security » Wireless question
Uniqs:
468
Share Topic:
RSS topic:
toggle:
flat / full
normal / watch
Posting:
Post a:
Post a:
wireless port scan attacked ??? »

Bill405

@anonymouse.org

Wireless question

When I connect to a wireless network, is there an ID, my computer name, or IP address that will how up in that network? If it does show any form of ID, is there a way to change that? where and how do I change that?

nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest

Re: Wireless question

Your MAC address shows up. That cannot be avoided, since you need it for communication.

I suppose you could probably set a different MAC address, but that's probably not worth the trouble.

If your system then uses DHCP to request an IP address, there is a good likelihood that your software will send your machine name to the DHCP server. It might perhaps also send the IP address most recently used (requesting that it be able to continue to use that). Presumably you could change your machine's name before connecting to the hotspot, and change it back later.
--
AT&T dsl; Westell 327w modem/router; openSuSE 11.0; firefox 3.0.10

antdude
A Ninja Ant
Premium,VIP
join:2001-03-25

Re: Wireless question

said by nwrickert See Profile :

If your system then uses DHCP to request an IP address, there is a good likelihood that your software will send your machine name to the DHCP server. It might perhaps also send the IP address most recently used (requesting that it be able to continue to use that). Presumably you could change your machine's name before connecting to the hotspot, and change it back later.
Can that be blocked with a firewall/software or is it required?
--
Ant @ »antfarm.ma.cx and »aqfl.net. Please do not IM/e-mail me for technical support. Use the forum! Disclaimer: The views expressed in this posting are mine, and do not necessarily reflect the views of my employer

nwrickert
sand groper
Premium,MVM
join:2004-09-04
Geneva, IL
·AT&T U-Verse
·AT&T Midwest

Re: Wireless question

Sending the name seems to be a windows kind of thing.

I mostly run linux, with a statically defined IP address, and the router does not know the machine name. But when I occasionally boot to Windows, and use the same static IP address, the router knows my machine name (I use a different machine name under Windows, so I can tell it is Windows sending that).

You might be able to block all dhcp requests in a software firewall. But you would have to assign a static IP to do that. So it isn't very practical when using wireless, since you are often using wireless on networks that you don't control and must depend on DHCP to assign the IP.
--
AT&T dsl; Westell 327w modem/router; openSuSE 11.0; firefox 3.0.10

antdude
A Ninja Ant
Premium,VIP
join:2001-03-25

Re: Wireless question

said by nwrickert See Profile :

Sending the name seems to be a windows kind of thing.

I mostly run linux, with a statically defined IP address, and the router does not know the machine name. But when I occasionally boot to Windows, and use the same static IP address, the router knows my machine name (I use a different machine name under Windows, so I can tell it is Windows sending that).

You might be able to block all dhcp requests in a software firewall. But you would have to assign a static IP to do that. So it isn't very practical when using wireless, since you are often using wireless on networks that you don't control and must depend on DHCP to assign the IP.
I wonder how one blocks Windows' name then. I know nbtstat can used if one knows the address and stuff.
--
Ant @ »antfarm.ma.cx and »aqfl.net. Please do not IM/e-mail me for technical support. Use the forum! Disclaimer: The views expressed in this posting are mine, and do not necessarily reflect the views of my employer
docrice

join:2008-03-31
Fremont, CA

Re: Wireless question

There are several "name leaks" (if you want to call it that) which occurs with Windows-based systems. In the DHCP Request packet, the hostname of the system is sent as option 12 (in an Active Directory directory environment, this helps the DHCP server update DNS). If dynamic DNS is supported, the client may also try to register their hostname into the DNS server and these are observable via the DNS update queries from the client.

You also have the infamous "NetBIOS" services on UDP 137 and 138 (and optionally TCP 139 which is more or less replaced via TCP 445 these days). These are legacy NetBIOS service enumeration / discovery methods for NetBIOS name suffixes (which denote the service type, whether it's a Workstation service, a PDC, etc.) which generally aren't useful unless you're running an NT 4.0 domain (almost no one these days) or you need your internal network to announce itself in such a manner due to the lack of centralized service enumeration methods (such as DNS SRV records). The Browser service on UDP 138 is there to help populate your "network neighborhood" browse list as well as help in the selection of a Master Browser, etc. (in the NetBIOS sense). All the NetBIOS stuff can be disabled under your interface's IP properties under Advanced -> WINS. You'll need to do this for each individual interface.

SMB / CIFS connections are under the "File and Printer Sharing" option, but there really isn't a "leak" in this sense since having a network share doesn't mean the machine broadcasts its availability.

Windows also tends to give itself away when you have SSDP involved running over UDP 1900. You can look that up. In Vista, you also have Link Layer Topology Discovery and other IPv6 stuff which clutters the network, although it's nice to help draw a network route diagram at a basic level.

Nerdtalker
Working Hard, Or Hardly Working?
Premium,MVM
join:2003-02-18
Tucson, AZ
clubs:

What docrice See Profile said! Seriously, I have yet to see such a concise and complete description of how many times and different ways Windows leaks the Hostname/Machine name.

It's somewhat amazing, actually. What I really love is how many different services actually grab that string differently. It differs from router to router but is almost always used to provide some sort of client "hostname."

Just change it to something ambiguous and you should be set.
--
"Some people never see the light till it shines thru bullet holes." -Bruce Cockburn

I'm testing Gmail's spam filters: Broadbandreports1@gmail.com
Spam: 12900+ messages currently using 406 MB.
Forums » Up and Running » Security » Wireless Securitywireless port scan attacked ??? »


Tuesday, 24-Nov 20:48:53 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.
page compression OFF
Most commented news this week
· [100] New AT&T Ad Campaign Hits Back At Verizon
· [84] New Bill Takes Aim At Higher Verizon ETFs
· [69] Apple Joins AT&T Verizon Snark Fest
· [39] In-Flight Internet Headed For Bumpy Landing?
· [32] Senators Want ACTA Made Public
· [30] Earthlink Suffers From Major E-mail Outage
· [30] AT&T Offers New Prepaid Wireless plans
· [28] Frontier Increases Modem Rental Fee
· [16] Vivendi In Way Of Comcast's NBC Desires
· [15] Charter Still Fighting With Creditors
Most people now reading
· Mysterious $800 Cash Deposit? [General Questions]
· Windows 7 boot manager editing questions [Microsoft Help]
· [Rant] Damn Sermons through my speakers! [Rants, Raves, and Praise]
· Climate Change Scandal Erupts After Email Hack. [Security]
· Connecting to Google Voice Via SIP [VOIP Tech Chat]
· 3.x Feral Druid - Bear Tanking Guide [World of Warcraft]
· "ISP owners could face jail under child porn bill" - CBC [Canadian Broadband]
· [Newsgroups] Newzleech is either down or gone for good... [Filesharing Software]
· What to use while demonoid is down? [Filesharing Software]
· [WotLK] Account STATUS: Frozen [World of Warcraft]