Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but on 192.168.2.x!

setup:

  • ubuntu 11.10
  • nmap 5.21
  • home wifi connection on private network (192.168.1.x)
  • wireless router setup to be on 192.168.1.1 / 255.255.255.0
  • DHCP enabled
  • only connected to our own secured wifi network
  • all our devices and computers are on the 192.168.1.x network
  • router logs dont show any 192.168.2.x IPs (DHCP leases & wifi logs only show our devices IPs)

nmap result subset:

$ nmap 192.168.2.0/24

Starting Nmap 5.21 ( http://nmap.org ) at 2012-07-05 21:30 CEST
Nmap scan report for 192.168.2.1
Host is up (0.045s latency).
All 1000 scanned ports on 192.168.2.1 are closed

Nmap scan report for 192.168.2.3
Host is up (0.048s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE
23/tcp open  telnet

Nmap scan report for 192.168.2.69
Host is up (0.045s latency).
Not shown: 993 closed ports
PORT     STATE SERVICE
80/tcp   open  http
111/tcp  open  rpcbind
139/tcp  open  netbios-ssn
443/tcp  open  https
445/tcp  open  microsoft-ds
631/tcp  open  ipp
2049/tcp open  nfs

Nmap scan report for 192.168.2.77
Host is up (0.067s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE
80/tcp open  http

Nmap scan report for 192.168.2.78
Host is up (0.044s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE
80/tcp open  http

Nmap scan report for 192.168.2.80
Host is up (0.012s latency).
Not shown: 841 closed ports, 149 filtered ports
PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
23/tcp    open  telnet
37/tcp    open  time
80/tcp    open  http
2000/tcp  open  cisco-sccp
5003/tcp  open  filemaker
5004/tcp  open  unknown
32769/tcp open  unknown
32770/tcp open  sometimes-rpc3

Nmap scan report for 192.168.2.84
Host is up (0.043s latency).
Not shown: 843 closed ports, 149 filtered ports
PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
23/tcp    open  telnet
37/tcp    open  time
80/tcp    open  http
5003/tcp  open  filemaker
5004/tcp  open  unknown
32769/tcp open  unknown

Nmap scan report for 192.168.2.89
Host is up (0.014s latency).
Not shown: 999 filtered ports
PORT   STATE SERVICE
80/tcp open  http

Nmap scan report for 192.168.2.90
Host is up (0.063s latency).
Not shown: 993 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
23/tcp   open  telnet
80/tcp   open  http
111/tcp  open  rpcbind
6000/tcp open  X11
8088/tcp open  unknown
...

here are some telnet responses:

$ telnet 192.168.2.80
Trying 192.168.2.80...
Connected to 192.168.2.80.
Escape character is '^]'.

Linux 2.6.10-mV01-00-54 (localhost.localdomain) (0)

dcm login:

and

$ telnet 192.168.2.90
Trying 192.168.2.90...
Connected to 192.168.2.90.
Escape character is '^]'.


        Welcome to Appear TV Embedded Software Environment


dvbs2 login:

looks like network equipment, digital TV etc. but none of these are connected to our router! Has anybody have any idea how could this be?

EDIT: somehow nmap --traceroute doesnt work in this case, but traceroute does return some interesting results:

$ nmap --traceroute 192.168.2.90

Starting Nmap 5.21 ( http://nmap.org ) at 2012-07-07 14:48 CEST
Warning: Traceroute does not support idle or connect scan, disabling...
Nmap scan report for 192.168.2.90...

$ traceroute  192.168.2.69
traceroute to 192.168.2.69 (192.168.2.69), 30 hops max, 60 byte packets
 1  RT-G32 (192.168.1.1)  1.240 ms  1.375 ms  1.589 ms
 2  10.17.64.1 (10.17.64.1)  10.396 ms  10.400 ms  10.372 ms
 3  192.168.100.13 (192.168.100.13)  14.912 ms  16.572 ms  16.487 ms
 4  192.168.2.69 (192.168.2.69)  13.146 ms  13.127 ms  14.658 ms

$ traceroute  192.168.2.90
traceroute to 192.168.2.90 (192.168.2.90), 30 hops max, 60 byte packets
 1  RT-G32 (192.168.1.1)  1.466 ms  1.418 ms  1.551 ms
 2  10.17.64.1 (10.17.64.1)  11.025 ms  11.005 ms  10.975 ms
 3  192.168.100.13 (192.168.100.13)  10.958 ms  15.729 ms  15.715 ms
 4  192.168.2.90 (192.168.2.90)  15.640 ms  15.561 ms  15.532 ms

I'm puzzled as to how I do have a link on 10.17.64.1 ? Where exactly in the RFC1918 is there a reference to this issue?

share|improve this question
1  
Might be worth trying to fingerprint them using Nmap? –  Peanut Jul 5 '12 at 20:24
5  
You probably are scanning a neighbor who has a misconfigured router (routing RFC1918 addresses). Do a traceroute (or nmap --traceroute) and see what hops are in between. If it belongs to someone else, leave it alone. –  bonsaiviking Jul 5 '12 at 22:06
add comment

4 Answers

Like bonsaiviking said, it probably belongs to a neighbour. Leave it alone and avoid the risk of getting in trouble with the law.

If you really want to find out more though, you can always try a few nmap scans.

nmap --traceroute 192.168.2.0/24
nmap -sV -A 192.168.2.0/24
nmap -O 192.168.2.0/24

More information should help you better pinpoint what kind of machines they are and where they are.

share|improve this answer
1  
Depending on where you live, an nmap -O or -A scan is illegal if you know they are hosts that you do not own. I'd put up a firewall to prevent all those hosts flooding your home network with traffic .... or attacks .... –  schroeder Jul 12 '12 at 23:31
add comment
up vote 3 down vote accepted

after some further scans, and traceroute diffs between different addresses on the internet, it turned out to be a private network as part of the ISP infrastructure, that would also explain the Digital TV equipment etc.

share|improve this answer
add comment

The equipment that you found it's a modular chassis used in video broadcasting. Is has an internal routing for the internal modules and it uses 192.168.2.x range, I have one at work. So it is definitely on your IPS network and they are not filtering it right.

share|improve this answer
add comment

I would run autoscan or angry IP scanner, take a look at what type of machines they are and if they have any shares that might identify the machines or owner. Also see if 192.168.2.1 is alive, if so then see if you can access it in Internet Explorer to identify the router that you are on and if it's your AP or not. Also disable WPS if you havent already on your router, way easy to crack passwords using reaver.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.