Belkin router... An unfamiliar address

[RayFinkle]

You know what they say......"You get what you pay for".............. Sad, but usually true............ :-(

 

[simono1]

simono1, are you saying that your router still shows that MAC address/host as connected?

There's NO WAY a hacker could have connected to your wireless router that fast if you're really are running WPA2!!

Does your router have any times related to that host?

One option you have is MAC address filtering. By now you know the MAC addresses of your 2 PCs. You can set up your router to ONLY allow those 2 MAC addresses to connect and then you are set.

The only caveat is MAC address spoofing. But, let's take this one step at a time.

All I can see is 3 addresses in the DHCP client list. One is that unfamiliar one. I thought about filtering but thought sense the wireless is now turned off... why? but I will if you think I should.

I refreshed it several times now and it stays there.

 

[Kari]

You know what they say......"You get what you pay for".............. Sad, but usually true............ :-(

In my opinion Belkin routers are really good, Belkin being my choice. If I forget this minor issue, and that I mentioned earlier about Belkin CP not obscuring PSK, I am a happy Belkin router user. I had problems with one (told here) but thanks for a lifelong warranty, I got it replaced.

Kari

 

[simono1]

Do you think that when I set-up the wireless connection back when only my computer had a wireless card, and we couldn't with the other, it is in my system and when I logon.... it is just showing that?

 

[wilywombat]

Doing a google on that i/p shows that it looks like a router based ip. Did you get the router second hand? If so there may have been a static route setup. I use Belkin like Kari and I have found that if I get something snarling up, it is sometimes best to reset the router completely to factory defaults and start over again...after making sure to write down the appropriate settings!!

 

[FliGi7]

simono1, are you saying that your router still shows that MAC address/host as connected?

There's NO WAY a hacker could have connected to your wireless router that fast if you're really are running WPA2!!

Does your router have any times related to that host?

One option you have is MAC address filtering. By now you know the MAC addresses of your 2 PCs. You can set up your router to ONLY allow those 2 MAC addresses to connect and then you are set.

The only caveat is MAC address spoofing. But, let's take this one step at a time.

All I can see is 3 addresses in the DHCP client list. One is that unfamiliar one. I thought about filtering but thought sense the wireless is now turned off... why? but I will if you think I should.

I refreshed it several times now and it stays there.

That address will stay there until the DHCP lease runs out. This could be one day to several weeks, depending how DHCP leasing is set up. It would only be anomalous at this point if it is staying there beyond one lease period after you shut off wireless.

Is anyone running a Virtual Machine on the network?

 

[simono1]

Doing a google on that i/p shows that it looks like a router based ip. Did you get the router second hand? If so there may have been a static route setup. I use Belkin like Kari and I have found that if I get something snarling up, it is sometimes best to reset the router completely to factory defaults and start over again...after making sure to write down the appropriate settings!!

This router was straight out of the box.... and I have had it for 2 or so years. At one time... I don't know... maybe a year ago, I must of created a static address because there is one there. I seen it as I was looking around for a way to get-rid of that unfamiliar address. I should of probably said something earlier.... Maybe I should start over, but we had a hard time setting it up the first time for whatever reason, and was on the phone about it forever, and it worries me to attempt it. I do have considerably more knowledge about things now, but I don't want to open that can of worms if I don't have too. There is another computer involved here. If you feel that it is in my best interest to proceed.... I will. Just wanted to lay it out for ya so you know where I'm at with it.

 

[simono1]

simono1, are you saying that your router still shows that MAC address/host as connected?

There's NO WAY a hacker could have connected to your wireless router that fast if you're really are running WPA2!!

Does your router have any times related to that host?

One option you have is MAC address filtering. By now you know the MAC addresses of your 2 PCs. You can set up your router to ONLY allow those 2 MAC addresses to connect and then you are set.

The only caveat is MAC address spoofing. But, let's take this one step at a time.

All I can see is 3 addresses in the DHCP client list. One is that unfamiliar one. I thought about filtering but thought sense the wireless is now turned off... why? but I will if you think I should.

I refreshed it several times now and it stays there.

That address will stay there until the DHCP lease runs out. This could be one day to several weeks, depending how DHCP leasing is set up. It would only be anomalous at this point if it is staying there beyond one lease period after you shut off wireless.

Is anyone running a Virtual Machine on the network?

Thank you for the info on that. And I'm sorry.... Yes, I am using virtual on my pc and on a external drive. We have had to for our college lab assignments. Wow... should of probably told you guys that one too. We are running Windows 7 virtually on an external hard drive.

 

[FliGi7]

All I can see is 3 addresses in the DHCP client list. One is that unfamiliar one. I thought about filtering but thought sense the wireless is now turned off... why? but I will if you think I should.

I refreshed it several times now and it stays there.

That address will stay there until the DHCP lease runs out. This could be one day to several weeks, depending how DHCP leasing is set up. It would only be anomalous at this point if it is staying there beyond one lease period after you shut off wireless.

Is anyone running a Virtual Machine on the network?

Thank you for the info on that. And I'm sorry.... Yes, I am using virtual on my pc and on a external drive. We have had to for our college lab assignments. Wow... should of probably told you guys that one too. We are running Windows 7 virtually on an external hard drive.

And what's the IP, computer name, and MAC of those virtual machines? It could easily be one of those if it's using NAT to acquire an IP. The mac address you listed earlier about the questionable machine is for an HP computer.

 

[simono1]

I'm on an emachine and the other is HP. We used the service that allows remote access to the computer about 6 months ago. had a problem we couldn't figure out. Maybe that's where it came from....

I have two internal drives... one is running Vista, the other Windows 7. In Vista, I'm running XP virtually whenever I want. And in Windows 7... I'm using XP mode when need be. Do to the fact I have office 2007 only on the vista drive, our labs sometimes call for documentation. A some of the labs are in XP. Rather that jump back-an-forth... I can enter XP on both. I prefer XP mode with 7 but... can't use 2007 there. Anyway, also have windows 7 (virtual) on an external drive. ITT-tech is still using XP and are converting over to 7, but until then, we're using 7 virtually.

I'll have to check the addresses their using, if any but, all the virtual stuff is on the emachine only. How would HP play into it? and I do not see a computer name that we use there... hmmm

 

[FliGi7]

I'm not sure, but if you're running a Virtual Machine on an HP machine, it could be using that HP's MAC address to acquire an IP for the virtual machine rather than the virtual machine's adapter MAC.

 

[simono1]

The name "ours" is the name of the computer... is this correct?

 

[FliGi7]

The host name is the name of the computer in full. So, it would be "ours-ay4j91epjq" as stated before. The hyphenated portion is a part of the full computer name. This computer name is sometimes automatically generated by the OS at install from the account name which could have been "ours" and then the machine likes to add a hyphen and a random set of characters to create a hopefully non-conflicting full name for the computer.

 

[simono1]

I'm on the drive with windows 7 now. I have 2 virtual machines, I think.... Windows virtual PC for XP mode, and VMware for that virtual 7 on the external drive. Am I correct at right clicking on each of these after expanding them in all programs, then properties, and looking for the name under the details tab? I see computer name and name there. Looking at both of them this way... I do not see that name "ours" or the other after the hyphen. I am going to restart into the Vista drive to also look.... I'll check back here to see if my idea was the right one... and again, thank you for your time.

Todd

 

[FliGi7]

Just right click on My Computer in any of the virtual machines to get to the full computer name.

 

[RayFinkle]

Fligi7, that was a pretty good idea to consider the possibility of a VM, but I don't think (I am pretty d*mn sure of this) a VM would use the MAC address of a specific hardware vendor, unless you intentionally set it that way. My VirtualBox VMs use a MAC address that comes back Cadmus Computer systems when I do a MAC address lookup. I googled, and apparently, VirtualBox never registered an official MAC prefix. VMWare apparently has its own MAC address prefixes:

Prefix Vendor
000569 VMWARE, Inc.
000C29 VMware, Inc.
001C14 VMware, Inc
005056 vmware, inc.


Anyway, if you do an ipconfig /all, it will show ALL of your interface MAC addresses, including your virtual interfaces. Look for that MAC address in there.

Also, I just remembered something else. I believe the default network configuration for VMware is NAT. If this is correct, then the VM's MAC will not show up on your router because the NAT virtual machine sets up an internal network (inside your PC), separate from your LAN. Network Address Translation is done inside your PC, and your router never even has a clue of the VM.

 

[simono1]

Sorry... I had to leave for awhile. This is what happened, after I went to both drives and fired-up VMware. I now have a new address added to the 3, making it 4 now, and the new address is the external drive with windows 7 on it. The host name (on the Belkin page) is the name I see while in the virtual machine, it's the computer name on the system page. Using the ipconfig /all, I can see my local connection- physical address with Belkin, and can see the same in the Belkin address page, but it's not the mac address. Down a-ways I see vmware network adapter vmnet1: the address after the host name is not the same as the one on the belkin page. the physical address on the ipconfig is different than the mac address on the belkin page. Is this what you mean by it not showing up.....

Any way... this has me thinking that I must of plugged in..... wait a minute.... I lost the virtual external windows 7 download the first time after I had used it on this PC. I think I had just threw a name in there the first time when we downloaded it because me and another were behind on the lab.... that's why I thought that "ours" kinda looked familiar after all these hours. I'll bet that's where that unfamiliar address is from. This is the first time I've plugged in the drive sense downloading the second windows 7.... and there's were 16 different disks going around the class at the time. It's a whole different disk and name... is that why i'm seeing a new address added?

What do you think... I plugged it into the other pc once, to upload some pictures but didn't use 7... that would be the HP pc I'm talking about. I'm still wondering why the address looks to be from HP?

 

[FliGi7]

Fligi7, that was a pretty good idea to consider the possibility of a VM, but I don't think (I am pretty d*mn sure of this) a VM would use the MAC address of a specific hardware vendor, unless you intentionally set it that way. My VirtualBox VMs use a MAC address that comes back Cadmus Computer systems when I do a MAC address lookup. I googled, and apparently, VirtualBox never registered an official MAC prefix. VMWare apparently has its own MAC address prefixes:

Prefix Vendor
000569 VMWARE, Inc.
000C29 VMware, Inc.
001C14 VMware, Inc
005056 vmware, inc.


Anyway, if you do an ipconfig /all, it will show ALL of your interface MAC addresses, including your virtual interfaces. Look for that MAC address in there.

Also, I just remembered something else. I believe the default network configuration for VMware is NAT. If this is correct, then the VM's MAC will not show up on your router because the NAT virtual machine sets up an internal network (inside your PC), separate from your LAN. Network Address Translation is done inside your PC, and your router never even has a clue of the VM.

This would explain everything. Sounds like we figured out the machine was/is a VM and there's nothing to worry about. If you're running these VM's with NAT, then their host names are gonna show up in your list of DHCP clients while using your local machine's (your HP) MAC.

 

[simono1]

Thank you so much for your time. Even if it takes awhile to figure it out.... it's worth it. The knowledge gained is not only a big help to me for future experiences... It also helps the next guy that might run into the same confusing situation.

I love this site.... Take care until next time,

Todd