Undetected device in network?

NIS2011
Vista Home Premium 32 bit
Vista SP2
IE8 browser
cable internet with cable modem/router

OK I know 192.168.0.1 is the “IP Address” of my router. In my network I see two items, MY PC and my iPhone. Thats cool, I understand that. But neither of those show an “IP Address” of 192.168.0.2. shouldn’t my PC have that (192.168.0.2) since my PC is first thing connected yo my router??
Its like the assignments from my router skipped over 192.168.0.2 and went to 192.168.0.3 and above
Can there be some malicious device some how connecting from my router via 192.168.0.2?

Hi,

 

if you check the router logs (on it's admin site), do you see any logs related that IP? If no, by some strange reason your router just skipped that address. Nothing to worry about :).


Calls wrote:
Can there be some malicious device some how connecting from my router via 192.168.0.2?

No.  Not if you are using WPA or WPA2 encryption.

Hi, Calls.  Routers do not assign IP addresses in linear order.  They are assigned on the basis of whatever IP address that device had last - or if there is a conflict - the Router assigns a new address randomly out of the pool of available addresses that your Router can assign.

 

This is a security feature.  Address randomization makes it harder for hackers to scan your system from top to bottom, since your IP addresses are spread out with unused addresses in between.

 

If you wish to assign your own desired IP addresses for each of your devices, you can do so in some Routers by using a feature known as "Static DHCP Address" selection.  See your Router manual for more info.  I use this, for example, to put my network printers at high addresses in the range so they are out of the way of the computers.  This keeps the machines and the printers from stepping on each others' toes when turned off and on again - and makes it easier to tell, just by looking at the IP address, whether I'm dealing with a printer or a machine.

 

 

Please note that making the above changes on a working system with an existing copy of NIS in place - plays absolute hob with NIS.  You are changing the location of stuff that NIS expects to find on the network.  This is not "wrong" - but you have to do a bit of housekeeping after making the changes to get NIS and the Router so both their brains are synchronized once the changes have been made.

 

So, once you have DNS Static configured as you wish in the Router, and saved your changes, and rebooted the Router and then rebooted each of your machines and network printers, you must go into NIS' Network Settings on each machine, go to Network Map, and select "Purge".  This will discard the obsolete map (with all your obsolete IP addresses) and allow NIS to rebuild the map on each machine with correct data reflecting your new configuration.

 

Note: The DHCP Server in your Router is "in charge" of doling out your IP addresses - unless Static IP addresses have been assigned.  Thusly, NIS is a "slave" to your Router.  However, because NIS is a Security Program - NIS thinks that having the rug suddenly pulled out from under it is rather suspicious - and reacts accordingly by clamping down on file sharing permissions and such.  In situations other than having the Router switch things about - NIS getting nervous about this kind of manouvering is quite correct.  So, because you are doing something that you know is OK - but NIS does not - you have to let NIS know that what is going on is OK (which you do by telling it to purge and then forcing a rebuild on each machine where NIS is installed).

 

 

Once the Network Map on each machine is properly rebuilt to reflect the "New Reality" imposed by the Router - all the ducks line up again and the world goes back to sweetness and light.  :smileyhappy:

 

 

so let me see if I understand this correctly.
192.168.0.1 is my router of course
So when it assigns IP address to my PC, it could skip over assigning 192.168.0.2 and assign 192.168.0.4 to my PC?
No my cable package also includes phone service (not through my PC but a seperate ) could that mean the router assigned 192.168.0.2 to my phone ? and then that not show up on my NISnetwork security map?

Correct. In any case, it's not worth worrying about. It doesn't mean malicious activity anyway. You might notice that you no longer have 192.168.0.2 sometime in the future, too, and that's normal; if you lose connectivity to your router for some reason, it will reassign the IP when connectivity is established again, but if the old IP is still in use, a conflict might be detected, and it will then assign another IP instead, and ditch the old one entirely when the lease expires. What you have described sounds like normal router behaviour and is nothing to lose any sleep over, or even give another thought.

Looks like it.  I only have a PC and a network router but the router is keeping the 192.168.0.5 address of the time when I had two wireless devices (it skipped .4).  I moved to a new homes (and there is no way there would be undetected devices in the network as the malicious hacker would be left behind at my old neighborhood, unless he's stalking me) but the IP address of my devices did not change (the router did not drop its IP address to 0.3.  So the IP address of the devices depends on a. the old address it was given and b. the address it is handed out by the router.  The skipping may also be due to an earlier conflict (i.e. you let your friend use your network [wired count]) and the router handed out your PC a new IP address.

 

One tip since you are digging around the router's setting: Turn off pinging.  This would reduce the chance of a hacker crashing by flooding it with ping requests.

Thanks all
To Send Of Jive- Not sure on what features my router has. It was provided to us by Time Warner cable. It seems to have multiple lights on it.( it is password protected and I dont have the password-wife does)
It is wireless And I know that the wired and wireless access is password protected as when my wife wants to use her iPhone via our wireless, she must input password.
Anyway, not sure if it has NAT and or WP1 Or WP2. It is from ubeeinteractive model number
U 10C022.01. when I go to that website, there is not a nice clean specs/features blurb
Perhaps other who use Time Warner Cable internet have this same router, since TWC provide it, and can help me to see if it is WP1 or WP2?

Go to the screen you set up your password and choose "WPA2-AES" as your security method.

 

The below screenshot shows my router setup.

 

 

sky.jpg

 

Also, I recommend you to disable your router from receiving from the ping port:

 

ping.jpg

Hi Calls:

 

Do not confuse WPA or WPA-2 encryption with WEP.

WEP is old and can be easily hacked.

 

Just a heads-up.

 

Atomic_Blast :)

If your router / PC does not support WPA2, use WPA-PSK, at the very least.  If your PC supports WPA2-AES, use it.  Just switch over to WPA2-AES and if you see any problems, use mix mode.  That way your router will either hook up to your device using WPA2 or WPA depending on its capabilities.  As the very *explosive* atomic_bomb (joke to the name "atomic bomb" :smileywink:) said, don't use WEP as it can be hacked easily within minutes with widely available tools.

actually beleive it or not, I dont want to screw around with my router. It is password protected. Just cant figure out if router has Wp1 and/or WP2. Just thought others might have the same router might know.


Calls wrote:
actually beleive it or not, I dont want to screw around with my router. It is password protected. Just cant figure out if router has Wp1 and/or WP2. Just thought others might have the same router might know.

I just pulled down the PDF user guide and all of the settings mentioned are user-configurable.  You really do need to go through the wireless settings to make sure you are secure.  You want to make sure that no one can access the router settings from the internet, that no one can join your network, and that no one can see what you are doing online when using the wireless (you are broadcasting, you know).  Norton can only protect information stored on your PC, it cannot encrypt your wireless traffic and it cannot keep outsiders from accessing the wireless network.