Norton Internet Security / Norton AntiVirus

[car825 Super Contributor]

---

Phil_D wrote:

I am in agreement with the remarks put forth by dickevans.  I want to know what devices are connected to my network and also what devices Windows thinks are connected.  This gives me more information to evaluate my own network security.

Although there may be numerous wireless devices in range, it is generally only devices using WPS that display in this manner.  There must be a WPS device on the user's machine and another remote WPS device within range.

It is due to a flaw in the WPS PIN broadcast exchange mechanism.  Basically, the two WPS devices are trying to communicate with each other in order to establish a connection.  There is more detail about this flaw here.

Personally, I think people should have concerns about using WPS.

Hope that helps.

---

I think Windows knows that these mystery devices are not connected to the network.  Check out the Network Location Name column in the Windows Network Folder.  Your devices have your network name in this column and the mystery WPS devices don’t  Doesn't this mean that the device is not actually connected?  I don’t mind if the device is on the Network Security Map as long as it is made clear that it is not an intruder.

Regarding WPS, many routers don’t allow you turn it off completely.  On my router I can disable the WPS Router PIN, which protects against the vulnerability you linked to, but I can’t turn off the other WPS modes (e.g., push button).

[dickevans Super RootKit Eradicator]

Added thought for consideration;

Using Norton DNS can also be useful in enhancing your protection. It's here: http://dns.norton.com

Choose the level of restriction that is appropriate and let your router do the job.

[tcpeed]

Okay, so I've changed some of the router settings.

At the moment whilst I'm sorting this out I have disabled wireless (thus disabling WPS) and connecting directly.

Every so often the unknown device (restricted) appears.

I can easily remove it, and then as you suggested I purge the security map in NIS settings.

I have left the map in the background to keep an eye on it and the device keeps re-appearing?

Any ideas?

Thanks.

[Phil_D Norton Fighter]

Does this device show up in the Windows Network Map?  (Control Panel\Network and Sharing Center  > See full map)

It might help if you could insert a screenshot of the Windows Map and the Norton Security Map.

Instructions for uploading screenshots can be found here.

Please be sure to redact any personal information such as 'Physical Address' (MAC)  and unique IP addresses.

Thanks!

[SendOfJive Norton Fighter]

Is the MAC address of the mystery device nearly identical to your router's MAC address (the router does not normally appear in the Network Security Map - you can find the MAC address in the router settings)?

[tcpeed]

I don't have sharing or network discovery active so I can't access the map (I'm set to public)

The unknown device ip address is the same as the router and the mac address the same apart from the last letter.

Thanks

[SendOfJive Norton Fighter]

---

tcpeed wrote:

The unknown device ip address is the same as the router and the mac address the same apart from the last letter.

---

That is because the unknown device is your router.  Some routers, such as the ubiquitous Linksys WRT54G, have multiple MAC addresses.  If you check the Status tabs in the router settings for the Linksys for example, you'll see three separate MAC addresses - one for the router that your ISP sees, one for your ethernet (wired) LAN, and one for your local wireless network.  The last digit differs by one for each of these MAC addresses.  While you are connected by ethernet wire, what you are seeing as the mystery device is probably the MAC address for the wireless component of the router.  You can check that by going into the router settings that I mentioned and verifying the MAC addresses shown in the Status -Router, Status- Local Network and Status-Wireless tabs.