0

I have a Cisco EPC3928 router on my home network. While scanning my network, I found an unknown Linux host.

Host details

  • Linux 2.6.9 - 2.6.30
  • 192.168.0.13, no IPv6 address
  • mac 00:11:E6:DE:AD:07 (Scientific Atlanta/Cisco)
  • Last boot same with router
  • open ports
  • 80 tcp http-proxy sslstrip (empty page, OWASP ZAP receives 400 response code)
  • 139 tcp netbios-ssn Samba smbd 3.X
  • 445 tcp netbios-ssn Samba smbd 3.X
  • 2468 tcp unknown
  • 4321 tcp http-proxy sslstrip (empty page)

I cannot filter or block it from the LAN, I don't believe it's likely able to access the Internet, but I cannot be sure.

I was able to find a few posts related to the MAC address and the case seems to be connected to Cisco EPC3928 routers. There is also Github code (FM-SmartLink), where the same MAC address is used. (I don't have enough reputation to post all links)

Is anyone familiar with this kind of case? What might cause it?

  • 3
    This might be related to the media server, see Possible Cisco Router Hack? (Resolved) from 2015. Disabling the media server made the device vanish in this post. – Steffen Ullrich Sep 3 '17 at 7:07
  • 1
    Thanks. That have not worked with me yet, but I wonder, how long was his while: "After a while, IP and network server disappeared...". But I'll report, if it works. – PaHa Sep 3 '17 at 7:57
  • It may be an internal OS like the Firepower module of the ASA firewalls. This should be investigated more, but I think that's it. Do you have a custom spec sheet for your device ? Any additional modules it may have should be listed there. – Overmind Sep 4 '17 at 9:31
  • I found applications from documentation: ● Supports DLNA 1.5 ● Samba server for file sharing (GPLv2) ● External NAS drives using USB 2.0 host ports. Possible solution seems to be that media/samba server, but I cannot make it disappear. – PaHa Sep 4 '17 at 17:37
0

TL;DR - There is nothing to worry about, appears to be caused by something running in the background of the OS.


This is a very common "issue" with "Cisco" EPC products and it appears to be an underlying OS "feature" that causes this "issue".

The problem comes from the fact that "Cisco EPC" products are not actually Cisco at all, they're Linksys products which have been rebranded as Cisco products. If you were unaware since 2003 until 2013 Cisco was the parent organisation of Linksys, all products that Linksys had developed or had been developing were sold as Cisco products not Linksys ones. The problem with that is Cisco never redeveloped these products, nor did they care to they simply just sold & marketed them as Cisco products but the truth remains - they aren't.

You may be wondering why that's a problem? Well it's not a problem as such it's more a thing you need to take into consideration, as these are not Cisco products they do not run the "real" Cisco IOS whilst I cannot provide you with a data-sheet for this information (As Cisco have since retired the product, removed all data from the website with the exception of forum threads and EOL'd it) what I can provide is an example of another product with the same commonality.

If you're familiar with Cisco equipment you will have probably heard of the SF & SG family, these are "Cisco" switches, like the EPC line they're not actually Cisco switches, they are in-fact Linksys switches this is evident when interacting with the CLI - one example would be when trying to use the backspace key, on a "real" Cisco product backspacing works as you would expect but on an SF or SG switch it doesn't - you must hold shift in order to use the backspace key. Another example is the following command boot system image-1 that command doesn't work on a "real" Cisco switch, take the 2960 family for example that command would actually be boot system flash:filename

The overall point is these products aren't running Cisco IOS (Which isn't Linux) what they're actually running is another OS based on Linux which tries to mimic Cisco IOS as closely as possible (Hence my examples). This explains why the OS shows as "Linux", this also explains why the MAC is a Cisco MAC because it is technically a Cisco product it's just not made by them. However, you shouldn't be worried about this, it's not causing harm to the network at all, it just appears to be something that runs in the back-end of whatever OS these EPC devices use.

As I said at the start Cisco haven't and probably will never release a statement on this partly because of the products being EOL'd and partly because of the fact that it's not something which is affecting you, it's just built into the OS to run in the background for an unknown reason which we'll probably never know.

If you read this you will see the device directly supports Samba server (Which I believe you already know) this will be whats going on, as the post you linked said switching it off should "fix" it.


Disclaimer - I am not directly affiliated with Cisco, I do not work for Cisco, I do however work for a Cisco partner. Anything in this answer is not the word of Cisco it is the word of my own as an individual based on research I've carried out. Please do not take this answer to be the official answer to the problem as Cisco have not and probably will not ever release an official statement on the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.