0

If an intruder gained access to a network impersonating the mac adress and the device name to appear like a familiar device in the network, how then is it possible to detect him in the router logs ? can the router see his card manufacturer or other informations that hackers can't change ? I know completely spoofing a device identity is impossible, correct me if i am wrong.

  • in my experience, if he duplicated your IP and MAC neither could access the network. So if there are 2 IP with the same MAC, that might work. – cybernard Feb 3 '18 at 15:50
  • You can't gain access to a network by spoofing MAC and name. He would need to crack your password to get access. If this is the case, change password to some 12 letter random string. – Aria Feb 3 '18 at 16:34
  • I didn't say this happened realy, i said in the case someone hacked the network and tried to appear like a normal user by using someone else identity (mac and device name) while the user is absent, how then is it possible to spot the intrusion in the router log later, i can't detect him by only relying on mac, device name and the date he connected. I hope you understand now. – P. Kod Feb 3 '18 at 18:47
2

MAC addresses, IP addresses, and DHCP hostnames are not security controls. All of those can be forged. I can also make my TCP/IP stack look like any operating system available -- the exact same signatures that tools like nmap and p0f use can be used to configure my network stack.

A strong WPA2 passphrase is the only effective wireless network security control most consumer routers offer. (And since you are using the term "router" for a device that your client connects to, I assume you mean a consumer wireless router.)

There is generally nothing logged on a consumer router that would allow you to detect a malicious device masquerading as a legitimate device.

0

You can try to identify operating system using packet fingerprinting.

For example, if your normal host is Windows, and attacker is using Linux, you can detect OS change. The only condition is that the remote host sends at least one packet during fingerprinting process.

You can perform such fingerprinting with nmap, for example:

nmap -O ipaddr

  • I didn't know about this technique but i think it should be used when the user is connected to the network but if the hacker is not using the network then running this command will not give us informations about his operating system. Will the router save this kind of data ? – P. Kod Feb 3 '18 at 22:37
  • Router will not save this kind of data. Routers usually save MAC address when giving DHCP addresses. – Aria Feb 3 '18 at 23:26
  • If the router doesn't save data like "card manufacturer" and "operating system" but can see it, can it recognize that the intruder is spoofing another identity and log him as a new device that has the same mac and the same device name ? If not i can say that the wireless LAN security isn't good enough. – P. Kod Feb 4 '18 at 0:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.