07-03-2012 07:46 AM - last edited on 07-05-2012 12:57 AM by Gayathri_R
I have a laptop which is connected wirelessly to my router. There are no other network connected devices or computers in the house.
Recently when I looked at the Network Map it shows 4 items. The first one is my PC I recognize the IP addresses of the other two which are my local and public IP addresses so I am guessing that they are both connected to my router. However, I do not recognize the 4th. The physical Mac address of the one that I do not recognize is <removed> and the other two Mac addresses that I do recognize are 1 letter out. Could someone explain to me if this is someone who is remotely connected to my router or if it is JUST the router but using a different IP address. I cannot see the IP address in the wireless set-up. Another thing is when I go on line to a website the unknown device also 'goes online'. I read somewhere that routers have 3 addresses. The trouble is I have not seen this one in my wireless set-up. Anyone expert help and advice would be greatly appreciated. The last thing to mention is that the unkown device says it's a NETGEAR which is what my router is.
07-03-2012 08:49 AM
The mystery device is your router, which has three MAC addresses - one each for WAN, LAN and wireless LAN. The fact that the three physical addresses you see only differ by one digit makes it obvious that all three belong to the same device - the odds of a separate device having a nearly identical MAC address as your router are next to impossible.
07-03-2012 09:02 AM
Thank-you for responding so quickly!! I just wondered because although the Mac address of the mystery device is only 1 letter different to the known addresses the ip address of the mystery device is 10.231.204.130, whereas my other two ip addresses are like 82.208XX and 192.168.XX and I had not seen this address anywhere in my wireless set up etc. So your 100% this is MY router?
07-03-2012 10:27 AM
The IP addresses don't tell you anything. What I was referring to is the MAC address, which identifies a device. If you have three identical MAC addresses, except for the final digit, they all belong to the same device. The private IP addresses are assigned by the router and do change. Also you may be confusing some of the public and private IP addresses. Most home routers will assign all devices something in the 192.168.X.X range. I am not sure why something in the 10.X.X.X range is showing up - that is also a private address which is not routable on the internet, but it would not be something that a router would assign automatically if the router is defaulting to the 192.168.X.X range. The 82.X.X.X is probably your public address assigned by your ISP.
07-03-2012 12:21 PM
Thank-you for you advice it is much appreciated!! Could it be possible that someone has hacked into my router and set up a private network inside my router? Please forgive me as you can tell I am not computer savy. I just find it odd that I have a private network address which says its online when I am. Your contiuned thoughts are really needed.
07-03-2012 12:47 PM
A little additional info:
My PC shows the 192.168.xx address there are then two NETGEAR devices one says 192.168.xx offline and the other NETGEAR device says 82.2.208.xx says online then there is the "mystery" NETGEAR which states 10.231.xxx.xxx which also states it's online. My wife uses the computer to connect directly to work with the Juniper Terminal Services Client. The software is installed on the computer. I don't know if that's relevant.
07-03-2012 04:15 PM
No you have not been hacked, and yes, it is quite possible that the Juniper Terminal Services Client may have been configured to use the 10.X.X.X IP address. It really isn't important - there doesn't seem to be anything unexplainable going on since the MAC (physical) addresses all belong to known devices.
07-04-2012 12:31 AM
You have pretty much put my mind at rest and for that I thank-you. Just one last question and then i will be satisfied. When I deleted the 10.xxxxx address which was on "protected" trust level from the network map it came straight back as a "shared" and although it has not come back since i purged the network map it is still showing in the "trust control" section does this also sound normal to you? Bearing in mind that the 10.xxxx address "appeared" to be active even when my wife was not directly connected to work. This is my last question. I really appreciate the time and patience that you have shown.
07-04-2012 02:48 PM
One last thing. I did a trace route to cnet.com and the first hop that showed-up was the 10.xxx.xxx address for the default gateway. Does this sound correct? Thank-you again.
07-04-2012 03:28 PM
Devices in Trust Control are devices that have been added to the Network Security Map manually. The 10.X.X..X address is a private IP address used for local networks and is not routable on the internet. If you are just trying to figure out what is on the network, compare the Physical Address reported in the Network Security Map with the MAC addresses of the devices on your network. I am not aware of how your network is set up, or how Juniper Terminal Services Client is configured to gain access. From everything you've said, however, I certainly don't think there is anything going on that couldn't be reasonably explained.