Finding the IP address of a walled in router

Question

Well my router is not quite calling out, "For the love of God, Montresor!" but close enough. Its somewhere where I have no easy physical access to it.

The short version? I need the ip address of a specific router in my network.

The long version:

I currently have 3 consumer routers, a Dlink DIR 865L I got from my ISP, which does DHCP, and all the other things you'd expect a wireless router to do. I have a second router acting as an ap - an asus RT-N56U connected directly to that AP. The asus is connected to a homeplug AV adaptor, and on the other end is a WRT 54GL. The WRT54GL primarily serves wired clients, though at the moment I have wireless capabilities.

I made this network map with a wireless connection, but it describes the wired setup perfectly as well. Note, the other two routers are recognised as such. I can just click on them and I'm in the setup page

I'd like to turn off wireless on the WRT54GL. I don't really need wireless and I'm using it as a switch. I just don't seem to remember what the IP address is far.

Here's what I know.

• The ornery old thing works perfectly, while being completely stealthy. Works with wired and wireless clients. In short, its being a very well behaved switch.
• It runs ddwrt
• Its got a static IPv4 address, set on the AP itself
• I can connect to the associated AP through wireless
• As far as I can tell, it passes on ipv6 addresses fine despite not actually being ipv6 enabled.

This is what I've tried so far:

1. Windows network mapping off windows 7. Dosen't show me the router at all except as a switch on a wired connection, and no useful information other than my AP name on a wireless connection directly to the router

2. Nmap on the entire IP address range my main router uses - I used a quick scan on zenmap. Nope. No luck there. Also tried angry IP scanner.

3. Checking arp tables - Nope, not there

4. Pathping, traceroute... the usual suspects. As suggested here

5. Checked client tables on both routers I can reach

6. ipconfig shows the ip address of the primary router

7. Turning it off and on again

8. Social engineering the last known IP address from myself and trying it.

Here's what I need to do - Work out what's the ip address of the router. Resetting it is not really an option I'd consider outside being the last resort.

While I suspect resetting it would let me set its ip address again, in the current location its in, its too much work. It functions fine (outside clogging up the already congested 2.4 ghz bands), and I'd need to actually get physical access to it to do this.

Edit: At this point, I've replaced the router with an actual switch. I've also managed to get it out of its virtual walled up state (it was on a high shelf behind a bunch of stuff), so I can do more through testing, outside the main network. At this point, I'm convinced I can't find the IP address cause there isn't one and our poor Fortunato router dosen't actually have one. Which come to think of it, means there's something odd going on

Answer 1

Why are you so sure your dd-wrt switch has an IP address? If you look up the DD-WRT wiki, it says that you can achieve a simple AP as follows:

Simple Version

Disable DHCP

Connect a LAN port to the main network / to the main Router's LAN port

Now you have an AccessPoint only setup, where clients are served IP details from your main network or main Router.

The WAN port is not connected, so it is not given an IP address. Switch functionality of course still works.

Let me expand on this. DD-WRT, like OpenWRT or OpenWRTUSB, uses hostapd for setting up the AP. Since you have a remote DHCP server, the hostapd interface will have to be bridged with an ethernet interface, so that all DHCP-related traffic can be properly forwarded to the DHCP server: the alternative (a NAT configuration) assumes that the wifi clients are inserted in a different subnet, with addresses dished out locally.

It is however a common misconception that bridges need an IP address to work: bridges are Layer-2 objects, not Layer-3. Having a bridge without an IP address means only that the device to which the ethernet and wifi interfaces belong cannot be reached from the network, that's all.

The fact that bridges do not require an IP address to function properly is discussed in many places, I will just point you to the one where I first read it. Here it is stated that:

It is worth mentioning at this point that it is perfectly possible for the bridge to be able to operate without having an IP address assigned to it. If this were the case, it would bridge packets between the two segments as shown above, but would not actually take part in any network exchanges on an IP level.

Stated otherwise: the fact that you can connect to the SSID by no means implies that the SSID has any IP address of its own.

Perhaps this is the reason why even a deep nma scan was unable to identify the address in question.

EDIT:

And yes, btw, I did test it on my Debian system. I do not expect it to be any different on DD-WRT.

Answer 2

Connect directly to the router via Ethernet cable, and disconnect all other connections to the router so that your computer is the only thing connected to it. Configure a static IP on your computer's IP address in the range that you normally use, then use Wireshark to capture some traffic. I would do the capture right after power cycling the router. You should be able to see any traffic the router is generating at that point.

Answer 3

Firstly, how are you using nmap? If you do a ping scan and the router is configured to ignore ICMP it won't show. Try scanning for open ports through the whole range, likely 80 or 443 or whatever port the webinterface runs on.

By the looks of it currently functions just as an AP and an Ethernet switch. As such it doesn't even need to have an ip address of it's own to function as it does right now. It will probably have an ip, but it might be in a different subnet altogether.

The first thing to try is to social engineer yourself and remember if the ip range used in your network has changed between now and the last time you checked that router. Perhaps that pops up the old range and the static ip of the router.

If that doesn't work you'll need to start scanning beyond your current subnet. Configure your local system with a fixed IP and scan the entire private range. You'll need 10.0.0.1 with subnet 255.0.0.0 and scan 10.0.0.0/8, 172.16.0.1 with 255.240.0.0 and scan 172.16.0.0/12 and lastly 192.168.0.1 with subnet 255.255.0.0 and scan 192.168.0.0/16. Assuming it has an internal IP you should find it in one of those ranges.

If you don't find it that way there won't be a way to configure it anyway since you can't talk to it. It might still be in some strange mode where it doesn't have an ip address of it's own.