4

I'm running a simple Node.JS HTTP server on my computer to test things before I push them to my real server, and forgot to close it when I stopped using it. I just looked at the logs and it shows that my home router (Linksys EA6900, 192.168.1.1) tried to load /HNAP1/ and /JNAP/:

Time IP ResponseCode PageRequested MimeType

2018-04-08T03:26:21.784Z 192.168.1.1 404 /HNAP1/ 
2018-04-08T03:26:21.881Z 192.168.1.1 200 /index.html text/html
2018-04-08T03:26:21.887Z 192.168.1.1 404 /JNAP/

All I can find online about this is what the HNAP protocol is and that there was a mass Linksys router exploit a few years ago, but this exploit was supposedly fixed long before I bought my router.

Is this normal for routers to try to do, or is my router possibly compromised?

EDIT: I just finished chatting with Linksys Support, I'm left to assume it's part of the Smart Wifi as he said the page requests are part of the router and it is needed ... since the router won't function without those

Improve this question
  • Interesting. I have a Linksys router, and I for one have never seen it's IP show up in web server logs on any of my networked devices. Do you have any other reasons to believe you were compromised? Did you change the default password on your router to something stronger? Was your firmware up to date? – nbering Apr 8 '18 at 23:32
  • This is the first issue I've ever noticed so no other reasons that I know of, the passwords have all been changed, and the firmware is up to date (Smart Wifi 1.1.43.182871). – ZomoXYZ Apr 8 '18 at 23:37
  • 1
    This does appear to have the same symptoms as security.stackexchange.com/q/73204/113999, but that was like 5 years ago. – nbering Apr 8 '18 at 23:57
  • 1
    @nbering if it was specifically looking for login pages it would be unexpected, but this is detection of protocol availability imo. If there are no requests to any pages other than these, I don't see a problem. – Nomad Apr 9 '18 at 0:12
  • 2
    I agree. It may be completely benign. The SmartWifi line also have a little "Network Map" feature, so it's possibly related to the discovery protocol they use to display device information. – nbering Apr 9 '18 at 0:15
3

HNAP is the Home Network Administration protocol.

I once ran in to the same issue when I was monitoring my network, only it wasn't with HNAP, but it's predecessor: UPNP.

Your Router should have a setting to enable or disable this feature, but it should be harmless if it's not exposed to the outside.

Basically, your router checks it's arp tables for available devices and sees if they have a HNAP service active by probing the directories you listed above.

I turned off the UPNP Service from my router configuration and things went silent, so I'd check the documentation of yours to do the same.

Improve this answer
  • so basically they are harmless requests? – ZomoXYZ Apr 9 '18 at 0:03
  • My ISP had the feature enabled because I could monitor active LAN devices on my network from the web interface of my router. They're likely just router polls they way you describe it, in which case they are harmless. Your router is patched, so unless some zero day is around I don't see how those requests could be bad. However, it remains an attack vector, and so should be treated as a "risk" (and turned off if unused). – Nomad Apr 9 '18 at 0:05
  • I just got off of a chat with Linksys Support and they confirmed that these requests are harmless, but also that they are needed and can't be disabled (even though there's an option to disable UPNP), could these requests be part of something outside of UPNP? – ZomoXYZ Apr 9 '18 at 0:19
  • You could log them for a week and see what they do. But if you only see the requests above and nothing worrying in the request or response body I think they're just normal HNAP requests. – Nomad Apr 9 '18 at 0:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.