I had a go at scanning my home network with nmap, doing a 192.168.0.0/16 netscan. To my surprise, the results shown multiple live devices not only on 192.168.1.x (where all our known devices are) but on 192.168.2.x!
setup:
- ubuntu 11.10
- nmap 5.21
- home wifi connection on private network (192.168.1.x)
- wireless router setup to be on 192.168.1.1 / 255.255.255.0
- DHCP enabled
- only connected to our own secured wifi network
- all our devices and computers are on the 192.168.1.x network
- router logs dont show any 192.168.2.x IPs (DHCP leases & wifi logs only show our devices IPs)
nmap result subset:
$ nmap 192.168.2.0/24
Starting Nmap 5.21 ( http://nmap.org ) at 2012-07-05 21:30 CEST
Nmap scan report for 192.168.2.1
Host is up (0.045s latency).
All 1000 scanned ports on 192.168.2.1 are closed
Nmap scan report for 192.168.2.3
Host is up (0.048s latency).
Not shown: 999 closed ports
PORT STATE SERVICE
23/tcp open telnet
Nmap scan report for 192.168.2.69
Host is up (0.045s latency).
Not shown: 993 closed ports
PORT STATE SERVICE
80/tcp open http
111/tcp open rpcbind
139/tcp open netbios-ssn
443/tcp open https
445/tcp open microsoft-ds
631/tcp open ipp
2049/tcp open nfs
Nmap scan report for 192.168.2.77
Host is up (0.067s latency).
Not shown: 999 closed ports
PORT STATE SERVICE
80/tcp open http
Nmap scan report for 192.168.2.78
Host is up (0.044s latency).
Not shown: 999 closed ports
PORT STATE SERVICE
80/tcp open http
Nmap scan report for 192.168.2.80
Host is up (0.012s latency).
Not shown: 841 closed ports, 149 filtered ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
37/tcp open time
80/tcp open http
2000/tcp open cisco-sccp
5003/tcp open filemaker
5004/tcp open unknown
32769/tcp open unknown
32770/tcp open sometimes-rpc3
Nmap scan report for 192.168.2.84
Host is up (0.043s latency).
Not shown: 843 closed ports, 149 filtered ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
37/tcp open time
80/tcp open http
5003/tcp open filemaker
5004/tcp open unknown
32769/tcp open unknown
Nmap scan report for 192.168.2.89
Host is up (0.014s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE
80/tcp open http
Nmap scan report for 192.168.2.90
Host is up (0.063s latency).
Not shown: 993 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
80/tcp open http
111/tcp open rpcbind
6000/tcp open X11
8088/tcp open unknown
...
here are some telnet responses:
$ telnet 192.168.2.80
Trying 192.168.2.80...
Connected to 192.168.2.80.
Escape character is '^]'.
Linux 2.6.10-mV01-00-54 (localhost.localdomain) (0)
dcm login:
and
$ telnet 192.168.2.90
Trying 192.168.2.90...
Connected to 192.168.2.90.
Escape character is '^]'.
Welcome to Appear TV Embedded Software Environment
dvbs2 login:
looks like network equipment, digital TV etc. but none of these are connected to our router! Has anybody have any idea how could this be?
EDIT: somehow nmap --traceroute doesnt work in this case, but traceroute does return some interesting results:
$ nmap --traceroute 192.168.2.90
Starting Nmap 5.21 ( http://nmap.org ) at 2012-07-07 14:48 CEST
Warning: Traceroute does not support idle or connect scan, disabling...
Nmap scan report for 192.168.2.90...
$ traceroute 192.168.2.69
traceroute to 192.168.2.69 (192.168.2.69), 30 hops max, 60 byte packets
1 RT-G32 (192.168.1.1) 1.240 ms 1.375 ms 1.589 ms
2 10.17.64.1 (10.17.64.1) 10.396 ms 10.400 ms 10.372 ms
3 192.168.100.13 (192.168.100.13) 14.912 ms 16.572 ms 16.487 ms
4 192.168.2.69 (192.168.2.69) 13.146 ms 13.127 ms 14.658 ms
$ traceroute 192.168.2.90
traceroute to 192.168.2.90 (192.168.2.90), 30 hops max, 60 byte packets
1 RT-G32 (192.168.1.1) 1.466 ms 1.418 ms 1.551 ms
2 10.17.64.1 (10.17.64.1) 11.025 ms 11.005 ms 10.975 ms
3 192.168.100.13 (192.168.100.13) 10.958 ms 15.729 ms 15.715 ms
4 192.168.2.90 (192.168.2.90) 15.640 ms 15.561 ms 15.532 ms
I'm puzzled as to how I do have a link on 10.17.64.1 ?
Where exactly in the RFC1918 is there a reference to this issue?
