Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm at my partner's lodgings at her university, and they use a proxy (I think, at least) running Ask4. I don't know the exact structure of their network, but it's likely to be some sort of proxy. The Ask4 service only allows 5 devices to be registered to a room at a time, however when I connected a router to an ethernet port, a page appeared stating that I'd connected a router, which would incur an extra charge.

My original plan was to spoof the MAC address of an already-registered device on the router (running DD-WRT), however this made no difference. After reading that this went against the terms of service, I thought better and removed the router.

My question is this: how can services, whatever they may be, determine what kind of device an attached MAC is? In this case, how can the proxy server determine that I've connected a router? Does it to something as naive as a tcptraceroute, or is there a standard that I don't know about to determine device type?

share|improve this question
up vote 6 down vote accepted

You can execute nmap and try Operating System guess for your router. I believe this plus MAC address ranges matching is what they are using to determine device type.

nmap -O your_ip

In my case:

  • 192.168.1.1
    • router/firewall
    • result: ZyXEL ZyWALL 2 firewall
    • OK
  • 192.168.1.7
    • router
    • result: No exact OS matches for host, MAC Address: ** (SMC Networks)
    • nearly match - SMCWBR14-G2
  • 192.168.1.200
    • client pc
    • result: Linux 2.6.X
    • nearly match - CentOS 5.8

Technique used is called OS fingerprinting

share|improve this answer

There are a few ways a device can give itself away, but the most obvious one is transmitting on the wrong pins on a 10Mbit or 100Mbit network. Nodes (PCs) and network devices (e.g. routers) transmit on different pins and the university system probably detects that.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .