4

I'm at my partner's lodgings at her university, and they use a proxy (I think, at least) running Ask4. I don't know the exact structure of their network, but it's likely to be some sort of proxy. The Ask4 service only allows 5 devices to be registered to a room at a time, however when I connected a router to an ethernet port, a page appeared stating that I'd connected a router, which would incur an extra charge.

My original plan was to spoof the MAC address of an already-registered device on the router (running DD-WRT), however this made no difference. After reading that this went against the terms of service, I thought better and removed the router.

My question is this: how can services, whatever they may be, determine what kind of device an attached MAC is? In this case, how can the proxy server determine that I've connected a router? Does it to something as naive as a tcptraceroute, or is there a standard that I don't know about to determine device type?

2 Answers 2

6

You can execute nmap and try Operating System guess for your router. I believe this plus MAC address ranges matching is what they are using to determine device type.

nmap -O your_ip

In my case:

  • 192.168.1.1
    • router/firewall
    • result: ZyXEL ZyWALL 2 firewall
    • OK
  • 192.168.1.7
    • router
    • result: No exact OS matches for host, MAC Address: ** (SMC Networks)
    • nearly match - SMCWBR14-G2
  • 192.168.1.200
    • client pc
    • result: Linux 2.6.X
    • nearly match - CentOS 5.8

Technique used is called OS fingerprinting

2

There are a few ways a device can give itself away, but the most obvious one is transmitting on the wrong pins on a 10Mbit or 100Mbit network. Nodes (PCs) and network devices (e.g. routers) transmit on different pins and the university system probably detects that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .