HELP! Mystery device in NIS11 Network Security Map

car825 · ‎03-28-2009

I recently upgraded to NIS 2011 and now there is an offline unknown device that Norton is seeing as a Cisco-Linksys Router/Switch. In the Windows 7 Network and Sharing Center it shows up as a Linksys Wireless-G Router model WRT54G2 with a different MAC than mine. In addition, my Router is a Linksys E3000 Wireless-N.

This is the same problem described by someone else in the attached link. I doubt it is a coincidence that it happened to both of us after upgrading to NIS 2011. What could it be?

http://community.norton.com/t5/Norton-Internet-Security-Norton/Mystery-device-in-Network-Security-Ma...

ChesterK · ‎06-09-2008

The network map may have picked up on a previous device that was connected to the network at the time. Please see the latest update to the thread you linked.

car825 · ‎03-28-2009

ChesterK wrote:
The network map may have picked up on a previous device that was connected to the network at the time. Please see the latest update to the thread you linked.

The mystery router is not mine and was never connected to my network. The strange thing is that it is not always in the W7 Network Sharing Center. It's as if it is going in and out of range. Why would someone else's router show up on the map and in my Network as an infrastructure device?

I can see many routers on the 'Connect to' list where you would expect to see them. Why would one make it to the network security map as an offline device?

car825 · ‎03-28-2009

car825 wrote:
I recently upgraded to NIS 2011 and now there is an offline unknown device that Norton is seeing as a Cisco-Linksys Router/Switch. In the Windows 7 Network and Sharing Center it shows up as a Linksys Wireless-G Router model WRT54G2 with a different MAC than mine. In addition, my Router is a Linksys E3000 Wireless-N.

This is the same problem described by someone else in the attached link. I doubt it is a coincidence that it happened to both of us after upgrading to NIS 2011. What could it be?

http://community.norton.com/t5/Norton-Internet-Security-Norton/Mystery-device-in-Network-Security-Ma...

I'm beginning to think the unknown device on Network Security Map is someone else's router that is configured for Wifi Protected Setup. Can someone confirm that a router configured this way will appear on the Network Security Map as an offline device even though it was never in my network? I thought the map was only supposed to show in-network devices.

car825 · ‎03-28-2009

car825 wrote:
car825 wrote:
I recently upgraded to NIS 2011 and now there is an offline unknown device that Norton is seeing as a Cisco-Linksys Router/Switch. In the Windows 7 Network and Sharing Center it shows up as a Linksys Wireless-G Router model WRT54G2 with a different MAC than mine. In addition, my Router is a Linksys E3000 Wireless-N.

This is the same problem described by someone else in the attached link. I doubt it is a coincidence that it happened to both of us after upgrading to NIS 2011. What could it be?

http://community.norton.com/t5/Norton-Internet-Security-Norton/Mystery-device-in-Network-Security-Ma...
I'm beginning to think the unknown device on Network Security Map is someone else's router that is configured for Wifi Protected Setup. Can someone confirm that a router configured this way will appear on the Network Security Map as an offline device even though it was never in my network? I thought the map was only supposed to show in-network devices.

I am concerned that NIS 2011 is showing a router that is not mine on the Network Security Map. My understanding is that the map is only supposed to show my in-network devices. I would feel better if someone could confirm that the map incorrectly shows 'unknown' routers with Wifi Protected Setup enabled as being in-network when they are really not part of the network. If there is a different explanation, I would like to hear that too.

delphinium · ‎11-21-2008

I notice that there are a few users on the Linksys support forum complaining of the same problem. It may show in the router access point or in the security software apparently. Have you checked in your router for settings that may shed some light on the issue?

Do you have a MAC access control in your router settings?

Since the routers are so close in manuafacture, and presumably close geographically, there may be some confusion if your network card isn't sure which one to connect to.

Under certain circumstances profanity provides relief denied even to prayer.
Mark Twain

car825 · ‎03-28-2009

delphinium wrote:
I notice that there are a few users on the Linksys support forum complaining of the same problem. It may show in the router access point or in the security software apparently. Have you checked in your router for settings that may shed some light on the issue?

Do you have a MAC access control in your router settings?

Since the routers are so close in manuafacture, and presumably close geographically, there may be some confusion if your network card isn't sure which one to connect to.

Thanks for the suggestion. I verified that the problem is not being caused by my router by switching back to my old D-Link DIR 655 router. The mystery device was still there. I deleted it from the map and it returned. I think NIS may have a problem here. The map is only supposed to show devices that are in my network. Correct? Why is it showing someone else's router that I have never connected to?

If my network card was confused about which router to connect to, why would NIS show the unknown router as already being in my network? I would expect it to be on the 'connect to' list with all the other routers in the area. When it is on the map NIS is telling me it is already in my network. The map is not supposed to show me routers that I could connect to. If I understand it correctly it is only supposed to show me devices that arealready in my network.

SendOfJive · ‎02-07-2009

Hi car825,

The Network Security Map only shows networks that you have joined so I do not think NIS is imagining things. Looking at the documentation on your router I see that there are two things that look like possible explanations:

The router is able to create two separate, yet simultaneous networks, one at 5 GHz and the other at 2.4GHz. Check your router configuration to see if this second network is what Norton is listing as a second router.
The router acts as a media server when a usb drive is connected to it. If you have a usb drive connected, try plugging and unplugging it to see if it is the mystery device.

floplot · ‎04-11-2009

Hello

I'm just wondering if the information in this article might have anything to do with this problem. I don't know anything about this really, but maybe this has something to do with it. If not, then sorry about the interruption.

http://www.zdnet.com/blog/security/security-flaws-haunt-cisco-wireless-lan-controller/7296?tag=nl.e5...

Success always occurs in private and failure in full view.

car825 · ‎03-28-2009

SendOfJive wrote:
Hi car825,

The Network Security Map only shows networks that you have joined so I do not think NIS is imagining things. Looking at the documentation on your router I see that there are two things that look like possible explanations:

The router is able to create two separate, yet simultaneous networks, one at 5 GHz and the other at 2.4GHz. Check your router configuration to see if this second network is what Norton is listing as a second router.
The router acts as a media server when a usb drive is connected to it. If you have a usb drive connected, try plugging and unplugging it to see if it is the mystery device.

I am using both bands (2.4 GHz and 5 GHz) but not the media server. I don't think that's it. In the Windows 7 network explorer I can see some details on the unknown router. It is a Linksys Wireless-G Router model WRT54G2 with a different MAC than mine. Windows 7 puts it in the Network Infrastructure category, not in my Network Location. So it's clearly not my Linksys E3000 dual-band router. I'm guessing that someone in my area has a router configured for Wifi Protected Setup. I read somewhere that Wifi Protected Setup sometimes appears as a network infrastructure device. For some reason NIS is putting it on the Network Security Map. Is my understanding of the map correct? is it only supposed to show devices that are actually in (or were in) my network?