2

I have a question on the following scenario:

Lets say, we have a normal LAN network with 192.168.1.1/24 gateway, DNS, DHCP servers all running on 192.168.1.1 ;

There is only one client: 192.168.1.200.

Now, for me, as an attacker, is it possible to use (any) IP ( just assume ip pool is 192.168.1.x is allowed), which the LAN router wouldn't detect and log in its general logs, (like DHCP) leases and so on?

The question is how to be undetectable (that is not generate any logs) on the router.

The attacker could use the clients IP = 192.168.1.200, but in logs you would have anyway 2 same IPs with (same) MAC addresses.

1
  • I think if you could draw and attach a diagram that would be best...
    – NULLZ
    Jun 1, 2013 at 0:55

2 Answers 2

3

Okay. I cleaned up your post to what i think it is you're asking for which is how to connect to a network without getting the router generating logs about my activity.

You can manually set your IP address of your machine to 192.168.1.199. Since your machine is the client, it must send a Discover request for an IP address to the router if it wants one. If you set it statically, the DHCP process never kicks in.

Additionally, you can manually set your DNS to something external like 8.8.8.8 (google's public/free DNS servers) but that will not let you resolve any internal client devices.

If you don't want someone knowing that you've connected to their LAN, your best bet in a scenario like this would be changing your MAC address randomly whenever you want to connect and using a Static IP. Most routers will store information on MAC addresses in order to assist in routing information correctly between clients.

2

Now, for me, as an attacker, is it possible to use (any) IP (just assume ip pool is 192.168.1.x is allowed), which the LAN router wouldn't detect and log in its general logs, (like DHCP) leases and so on?

It depends on the router. Cheap SOHO routers, once programmed for a given DHCP address pool, will blithely accept packets from addresses in the pool even if they did not give out those addresses.

In such a scenario, just grab IP address 192.168.1.201 and Bob's your uncle.

That very same strategy would lead to an alert being immediately logged by a more clever router as an obvious anomaly. Often, static IP alerting is set to "off" in order to accommodate users which may want to assign IPs in a quick-and-dirty way (e.g. printers) and don't want to be bothered with properly partitioning and configuring the network.

So basically it all boils down to the network "budget" in money and care. A carelessly configured or underbudget network will let you effortlessly connect unlogged, and actually it's likely not to have logs in the first place, or maybe there are but nobody remembers them anymore (or they were received by someone that long since has classified them "spam": I've seen that happen).

On a more carefully maintained network, maybe with a higher-end router with features that are known and used by the network administrator, you probably won't even be able to connect because your MAC address is not known. You may be able to circumvent that, if you change your MAC address to that of a device that's known to the system but not currently in use (e.g. a printer - and they often have the MAC printed on the network plaque on the back, or it's on an easily reachable "Printer Status" page that can be either displayed or printed). Even so, you'd be wise to plug the computer in the same port where the printer was.

(I seem to remember a blog article somewhere on the possibility of running nmap on newly connected devices recognized through ARP querying, both for fingerprinting and security auditing. I can't find it just now. But in theory at least, even if you connect to an unencrypted wired LAN with a valid MAC and from that MAC's port, it is still possible to detect that you aren't a printer after all).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .