Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm at my partner's lodgings at her university, and they use a proxy (I think, at least) running Ask4. I don't know the exact structure of their network, but it's likely to be some sort of proxy. The Ask4 service only allows 5 devices to be registered to a room at a time, however when I connected a router to an ethernet port, a page appeared stating that I'd connected a router, which would incur an extra charge.

My original plan was to spoof the MAC address of an already-registered device on the router (running DD-WRT), however this made no difference. After reading that this went against the terms of service, I thought better and removed the router.

My question is this: how can services, whatever they may be, determine what kind of device an attached MAC is? In this case, how can the proxy server determine that I've connected a router? Does it to something as naive as a tcptraceroute, or is there a standard that I don't know about to determine device type?

share|improve this question
up vote 6 down vote accepted

You can execute nmap and try Operating System guess for your router. I believe this plus MAC address ranges matching is what they are using to determine device type.

nmap -O your_ip

In my case:

    • router/firewall
    • result: ZyXEL ZyWALL 2 firewall
    • OK
    • router
    • result: No exact OS matches for host, MAC Address: ** (SMC Networks)
    • nearly match - SMCWBR14-G2
    • client pc
    • result: Linux 2.6.X
    • nearly match - CentOS 5.8

Technique used is called OS fingerprinting

share|improve this answer

There are a few ways a device can give itself away, but the most obvious one is transmitting on the wrong pins on a 10Mbit or 100Mbit network. Nodes (PCs) and network devices (e.g. routers) transmit on different pins and the university system probably detects that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.