LnS and router question

Discussion in 'LnS English Forum' started by Anth-Unit, Apr 3, 2011.

Thread Status:
Not open for further replies.
  1. Anth-Unit

    Anth-Unit Registered Member

    Joined:
    Oct 13, 2006
    Posts:
    108
    I've been playing around with look n stop, and I have been noticing a lot of traffic being blocked that says Type: ETH 0006. Now, most of these connections are coming from wireless clients that are connected on my wireless network. The two main mac addresses are from devices that I recognize, but when I changed the password on my wireless network, and these devices no longer have the correct wifi password, Look n Stop is still recording inbound connections from these machines. I'm running a Linksys router flashed with tomato firmware, and I'm using WPA2 with AES encryption.

    My question is, if they no longer have the correct wireless password, why are they still able to send packets to machines connected to my router? Is this a security risk?
     
  2. Stem

    Stem Firewall Expert

    Joined:
    Oct 5, 2005
    Posts:
    4,948
    Location:
    UK
    Have you any more info on the packets?

    It may just be noise you are seeing (such as broadcasts from the other nodes), and not packets routed through the router.


    - Stem
     
  3. Anth-Unit

    Anth-Unit Registered Member

    Joined:
    Oct 13, 2006
    Posts:
    108
    This is what I get when I look at the packet's content in LnS:

    Rule's name: Block: All other packets
    Direction Internet >> PC

    Source Address: Device on my network
    Destination Address: FF:FF:FF:FF:FF:FF

    Type: 6

    Is this normal traffic? I don't get these alerts when the device has a correct wireless password, only when I change it to something these devices do not have.
     
  4. Stem

    Stem Firewall Expert

    Joined:
    Oct 5, 2005
    Posts:
    4,948
    Location:
    UK
    If the devices cannot connect to the gateway(router) then they will broadcast, attempting to connect/waiting for a reply. When/if the devices connect to the gateway(router), then they will stop the broadcasts. So yes, it will be normal traffic.


    - Stem
     
Thread Status:
Not open for further replies.