5

I just did a quick scan of my home network and I found this mysterious Intel desktop, looks like its an intel ethernet chipset but I just thought the name "QMDL" was sketchy and was wondering if anyone has ever seen something like this? I was wondering if it could be malicious or someone trying to look at my network traffic.

  • 1
    "desktop-xxxxxx" is the default hostname Windows 10 uses, so it could be a Windows 10 device. Not certain (anyone could just spoof that) but it's a clue. – André Borie Jul 20 '17 at 6:14
2

There is only one way to know for sure that whether it is a rogue device - verify that it is a device you own or not. While you do that, consider the following scenarios.

  1. Verify if it was a machine connected by the people who installed the router.
  2. Verify if it is a VM running on one of your machines in bridged mode.
  3. Verify if it is a mobile device like a surface tablet.

If the above three cases are invalid and the device isn't your own machines, it is likely to be rogue. If it is still online you can perform a port scan and see the results and try if you can fingerprint the same.

To make sure that it isn't snooping your network, use wireshark and see the packets from that particular IP and your router. If there are ARP responses which binds the rogue machine's MAC and your router's IP, there is a man-in-the-middle attempt and you are being snooped.

Comment below if you need the specifics on how to perform any of these.

  • That was really helpful thanks man, I actually kind of freaked out and removed it from the network before i installed wireshark so I assume there is no way for me to go back and see whats going on. Also if this was a man in the middle attack would this guy have to be within a certain proximity of me to snoop? or could they be located anywhere in the world? I do have someone who was recently messing with me a few towns over and I know exactly who the kid is so that's why I'm wondering. – user151357 Jun 19 '17 at 21:15
  • In this case, for an MITM, the device has to be inside the network – hax Jun 21 '17 at 19:19
  • @user151357 he doesn't have to be next to you. If he got access to your network he can do his MiTM remotely. – sir_k Oct 18 '17 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.