Windows message saying 2 Pc's using my IP.

AndyPix

spud17 wrote: »

Do you mean the WPS pin?:)

Its been a long day

AndyPix

joe134 wrote: »

No one can access wifi without it.

The most certainly can

joe134 wrote: »

They could piggyback, but could they monitor my ipad ?

Yes, once connected to your network they can perform any kind of "man in the middle attacks"
eg Poison your ARP cache so that ALL your traffic flows through their machine and they can see what they like ..

psychic_teabag

spud17 wrote: »

In answer to OP, on one machine, wouldn't ipconfig /release then ipconfig /renew have worked?

Not necessarily... if the windows machine was the legitimate user of the address, the dhcp server could just give it the same address again. I think dhcp protocol does have a procedure to detect clashes, but if the rogue machine is not connected at the time you do the renewal, the clash will not be detected during the renewal.

joe134

AndyPix wrote: »

The most certainly can




Yes, once connected to your network they can perform any kind of "man in the middle attacks"
eg Poison your ARP cache so that ALL your traffic flows through their machine and they can see what they like ..

Thanks Andy, I have seen and read about man in the middle, and how they sit and Monitor all your doings with wifi, especially at IT Cafes.
How does one connect the Ipad with ethernet then,as I would prefer to be hard wired for banking etc,with ipad , if possible,it's the only time I use it, that's why I always keep my Pc ethernet connected, not wifi
.It's never moved.

AndyPix

The thing is, even if you could connect your ipad via ethernet (you cant) , then the simple fact that an attacker has conencted to your wifi, allows him to sniff your whole network , not just other wifi devices ..
So the same problem applies.


I am an "ethical hacker" in my spare time and i can tell you that the only way to keep me out of your network is to disable WPS on your router.


If you need help on how to do this then let me know


As iv said before on these forums, it boggles my mind how this is not disabled out of the box, because the hardware vendors are very aware of this issue.


Some people will witter on about locking down the router to specific mac addresses etc but in reallity it is simplicity itsself for me to just sniff the traffic going to and from your router and then just spoof a mac address that i can see is allowed to talk to it !!



Andy

GunJack

psychic_teabag wrote: »

Not necessarily... if the windows machine was the legitimate user of the address, the dhcp server could just give it the same address again. I think dhcp protocol does have a procedure to detect clashes, but if the rogue machine is not connected at the time you do the renewal, the clash will not be detected during the renewal.

in theory, if dhcp was perfect, a conflict would never happen, even if some devices were using a static IP address....however, we live in an imperfect world.... in theory it would be easy to write a routine within dhcp that even if a device using a static IP tried to join the network and it's addy had been allocated to another device, then the other device's addy would be re-allocated automatically (with a temporary loss of connection during the process)...

In practical terms, if assigning a static IP, just use one well away from the normal range dished out by the router, eg. dhcp starts allocating at .2, .3 etc., use .40 for your static IP...not many homes are going to have 39 devices trying to get a connection

psychic_teabag

GunJack wrote: »

in theory, if dhcp was perfect, a conflict would never happen, even if some devices were using a static IP address....however, we live in an imperfect world.... in theory it would be easy to write a routine within dhcp that even if a device using a static IP tried to join the network and it's addy had been allocated to another device, then the other device's addy would be re-allocated automatically (with a temporary loss of connection during the process)...

I don't think dhcp server has any way to revoke an IP address after it has given it out. You could configure very short lease times so that the client has to keep renewing, which would be an opportunity to change the address.

While in home networks, the router is dhcp plus wireless master plus ethernet hub, that's not a requirement. The dhcp server may never be aware there's a clash - it wouldn't see packets that are not intended for it, unless it is actively snooping the network.

In practical terms, if assigning a static IP, just use one well away from the normal range dished out by the router, eg. dhcp starts allocating at .2, .3 etc., use .40 for your static IP...not many homes are going to have 39 devices trying to get a connection

Or even better, tell the dhcp server to only give out address 2..39 so that 40 and up can be allocated statically.

GunJack

psychic_teabag wrote: »

I don't think dhcp server has any way to revoke an IP address after it has given it out. You could configure very short lease times so that the client has to keep renewing, which would be an opportunity to change the address. this is the current situation, I was referring to re-writing dhcp to accomodate dynamic reallocation

While in home networks, the router is dhcp plus wireless master plus ethernet hub, that's not a requirement. The dhcp server may never be aware there's a clash - it wouldn't see packets that are not intended for it, unless it is actively snooping the network.



Or even better, tell the dhcp server to only give out address 2..39 so that 40 and up can be allocated statically. providing the user is competent to do so, and the router fw allows it

I was being theoretical... the point is that things could be improved on, to cut down the possibility of IP conflicts happening..whether this ever happens in practice? - slim

joe134

Hi Guys, back again.
Just a question.
In my Router settings.
There is my IP address 198.168.1.1
Subnet task.255.255.255.0

Then a Second different IP address 198.168.2.1
Same second Subnet Task.255.255.255.0

What is the second different IP address for.

Still getting to grips with Router.

AndyPix

You seem to have 2 subnets ..
Was the router new to yourself or did you get it from somewhere else ..


By ther way, it's subnet Mask