Connected, yet not...

RWB

Note this is not my problem, and nor am I able to help this person, but it's got a big WTF light going off in my head. This is about a guest at a hotel I support internet for.

So I got a call moments ago, I was working on it for a long time. A guest at one of our hotels called up from the lobby having trouble connecting to the lobby's wireless. FYI, we use a business class IP scheme of 10.x.x.x. He was also on a MAC, but I know them fairly well so no biggie.

The guest was connected to the proper SSID, he had a valid IP of 10.0.0.11, he did have a strange router/gateway IP of 10.0.0.1 instead of 10.0.0.4 which is the server IP. But our server did not have him listed... I even had him locate the MAC address but I think it was his Ethernet MAC because of how it was listed on the sticker, couldn't locate any other physical address which he should have two since he has an Airport and Ethernet.

I was of course showing two others in the active list for the lobby AP passing information both ways, but neither was him.

All I can think of is that he was connecting to an AP that is not ours who is merely mimicking our setup. What do you guys think?


||EDIT:||
I checked in on the server again, he's in his room now with Ethernet connecting with a different MAC address. So maybe the MAC he did give me was the wireless... either way it wasn't ever showing in our system.

mtrox

I'm just curious...do you have a 10.0.0.1 anywhere on your system? Almost makes you wonder if some hacker rented a room and fired up his own wireless with your SSID doesn't it? If you see that again you might want to see what channel the 10.0.0.1 wireless is on.

RWB

That's a good idea, but I do not have a listing of the AP's channel numbers, damn I wish I did. But that is something I am working on, among others.

But nothing I know of ours has 10.0.0.1, it starts at 10.0.0.4, then the guest IP ranges from 10.0.0.12 - 10.0.0.250. Which now that I notice this I can't see how someone could have 10.0.0.11, yet someone on the server later on that night(not the guy I spoke with since I could see him still in his room) had 10.0.0.11. BTW I am looking directly at the server settings so now I am all confused HA HA! I need to speak with the Operations Manager I guess.

mtrox

I'll be curious. You read about people stealing stuff in public WiFi's, but I've never actually seen it.

RWB

Well I mean we use a VLAN so that no-one can see each other, they would need to have a packet catcher of sorts and stick around in order to catch just their internet traffic. I'll tell you what... being in this job I can clearly see from the traffic people pass that the great majority of people out there have all kinds of virus's and crap on their computer because I can see all the requests. At least in terms of IP's and ports. At this same hotel we had some crazy crap go one yesterday with two people generating all kinds of random traffic, one was even a DOS attack. Another was a really bad virus or something...

Based on that and that apparently we're still having trouble at the hotel causes me to think someone is attacking us. Of course everything right now is hunky dory.