DHCPD logs show PC's requesting IP addresses from router when they are turned off. Are our log files incorrect?

bloopiebloopie

We have a small office and on checking the router logs I noticed that a number of computers have requested IP address from the office router outside of business hours.

This is the log file output:

188 2016-11-18 06:50:58 DHCPD   Notice  Send ACK to 192.168.1.101
189 2016-11-18 06:50:58 DHCPD   Notice  Recv REQUEST from F8:0F:41:D0:4C:FB
190 2016-11-18 06:50:58 DHCPD   Notice  Send OFFER with ip 192.168.1.101
191 2016-11-18 06:50:58 DHCPD   Notice  Recv DISCOVER from F8:0F:41:D0:4C:FB
192 2016-11-18 06:41:40 DHCPD   Notice  Send ACK to 192.168.1.131
193 2016-11-18 06:41:40 DHCPD   Notice  Recv REQUEST from 64:EB:8C:53:D8:6E
194 2016-11-18 04:45:00 DHCPD   Notice  Send ACK to 192.168.1.143
195 2016-11-18 04:45:00 DHCPD   Notice  Recv REQUEST from 98:EE:CB:03:B8:69
196 2016-11-18 03:58:28 DHCPD   Notice  Send ACK to 192.168.1.143
197 2016-11-18 03:58:28 DHCPD   Notice  Recv REQUEST from 98:EE:CB:03:B8:69
198 2016-11-18 03:40:30 DHCPD   Notice  Send ACK to 192.168.1.111
199 2016-11-18 03:40:29 DHCPD   Notice  Recv REQUEST from F8:0F:41:D0:4D:6E
200 2016-11-18 02:33:52 DHCPD   Notice  Send ACK to 192.168.1.127
201 2016-11-18 02:33:52 DHCPD   Notice  Recv REQUEST from FC:3F:DB:21:34:E2

The employees turn off their computers when finished work. I have confirmed that all but two of the logged MAC addresses belong to computers in our office.

We recently had a security breach. We reset the router, all the admin passwords and the WiFi passwords.

Is it possible that these computers could be turning themselves on outside of business hours and making themselves accessible to people outside of our network?

Hennes

Ask for the first question asked:

Is it possible that these computers could be turning themselves` …

Yes, computers can turn themselves on and have had this capability for ages. For IBM compatible PCs this is normal since they got ATX PSU's. (About since 1995). If you go to the motherboards firmware (aka BIOS or UEFI) you often have an option configure this. Quite useful if you have an old PC and want it to power up and boot before you get to the office.


The second part of your question

… and making themselves accessible to people outside of our network?

is independent from the first part. If that happens when the computers power on (regardless of whether they powered on by itself or by you pressing the power button) then you have a problem. If that is the case then the security breach has not been fixed yet.


Lastly, if you got the MAC address then you can look to the first three bytes. They will tell you which manufacturers made the network card that is requesting the IP. This can help to identify the source (e.g. only DHCP reqs from printers, or from mobile (personal?) phones…

I looked up the addresses in your post:

MAC addresses starting with F8:0F:41 or with 98:EE:CB belong to Wistron InfoComm. According to Wikipedia this firm makes tablets, mobile phones and other devices running the Chrome OS.

MAC addresses starting with 64:EB:8C belong to Seiko Epson Corporation. Those might be printers (then again, printers probably have their own IP range in an office, though possibly with a reserved MAC → IP on the DHCP server).

MAC addresses starting with 4C:A1:61 belong to Rain Bird Corporation. Every search I did on that name resulted in a sprinkler firm.


Finally:

Are our logfiles incorrect?

I doubt that. Somethings seem to be requesting IP information. This is being logged. No fault in the logging. The bigger problem is why are they doing that out of office hours? Is there a lawn sprinkler system which is powered on all day (and which is probably supposed to be on 24/7)? Are there printers which are not powered off but instead go to sleep mode? Are there laptops or PCs which do not get properly turned off but which instead go to a low power (sleep?) mode, detect low battery and power up in order to go to a deep sleep mode?

Basically, find out which device (should be easy, you got MACs and IPs, so you can either use documentation to look up which PCs it is, or use the router to find out which device it is). Then research further from that last devices. (In the case of a windows computer try powercfg lastwake).

この記事はインターネットから収集されたものであり、転載の際にはソースを示してください。

侵害の場合は、連絡してください[email protected]

編集
0

コメントを追加

0

関連記事

分類Dev

Add multiple static IP's for a client in ISC dhcpd4

分類Dev

How to get sensor data in service when screen is turned off?

分類Dev

Git log to show a user's modified files sorted by type

分類Dev

Why does Ubuntu boot from flash with the screen turned off?

分類Dev

Different level of logs in different log files

分類Dev

When I console.log a user's radio button selection, what logs is always one behind

分類Dev

When I run Windows Virtual PC on Windows 7 it just shows me the folder with my Virtual PC files. What's up?

分類Dev

notebook turned off while upgrading

分類Dev

Is it necessary to commit DVC files from our CI pipelines?

分類Dev

Can I safely remove a usb device from a win 7 computer that is turned off?

分類Dev

How to whilelist specific IP addresses from AWS WAF

分類Dev

How are local ip addresses separated from public ones?

分類Dev

String turned to Object when passed from client to nodeJS

分類Dev

Only 2 Clients connected, yet router shows 4 IP addresses in the DHCP list

分類Dev

Windows 8 : Hook explorer.exe so that when PC startup, it will start the specified application and show the application's UI

分類Dev

How to get access-logs from OpenShift router (HAProxy)?

分類Dev

What are these weird IP addresses?

分類Dev

IP addresses in distributed systems

分類Dev

SCRIPT1030: Conditional compilation is turned off

分類Dev

How to find out what turned off the computer?

分類Dev

Would there be any problems with DEP turned off?

分類Dev

Today when i turned on my pc and want to test app got this error. Don't know how to fix

分類Dev

To obtain logs from the last 5 months that show jobs that have failed

分類Dev

Identify all relevant ip addresses from ruby Socket.ip_address_list

分類Dev

Angular element logs incorrect value

分類Dev

DHCPD ip6、enp2s0のsubnet6宣言なし(2001:470:1f1a:5b3 :: 2)

分類Dev

DHCPD ip6, No subnet6 declaration for enp2s0 (2001:470:1f1a:5b3::2)

分類Dev

Enforce user time restrictions to log out or off from Windows 7

分類Dev

Are log files written to when a buffer fills or in 'realtime'?

Related 関連記事

  1. 1

    Add multiple static IP's for a client in ISC dhcpd4

  2. 2

    How to get sensor data in service when screen is turned off?

  3. 3

    Git log to show a user's modified files sorted by type

  4. 4

    Why does Ubuntu boot from flash with the screen turned off?

  5. 5

    Different level of logs in different log files

  6. 6

    When I console.log a user's radio button selection, what logs is always one behind

  7. 7

    When I run Windows Virtual PC on Windows 7 it just shows me the folder with my Virtual PC files. What's up?

  8. 8

    notebook turned off while upgrading

  9. 9

    Is it necessary to commit DVC files from our CI pipelines?

  10. 10

    Can I safely remove a usb device from a win 7 computer that is turned off?

  11. 11

    How to whilelist specific IP addresses from AWS WAF

  12. 12

    How are local ip addresses separated from public ones?

  13. 13

    String turned to Object when passed from client to nodeJS

  14. 14

    Only 2 Clients connected, yet router shows 4 IP addresses in the DHCP list

  15. 15

    Windows 8 : Hook explorer.exe so that when PC startup, it will start the specified application and show the application's UI

  16. 16

    How to get access-logs from OpenShift router (HAProxy)?

  17. 17

    What are these weird IP addresses?

  18. 18

    IP addresses in distributed systems

  19. 19

    SCRIPT1030: Conditional compilation is turned off

  20. 20

    How to find out what turned off the computer?

  21. 21

    Would there be any problems with DEP turned off?

  22. 22

    Today when i turned on my pc and want to test app got this error. Don't know how to fix

  23. 23

    To obtain logs from the last 5 months that show jobs that have failed

  24. 24

    Identify all relevant ip addresses from ruby Socket.ip_address_list

  25. 25

    Angular element logs incorrect value

  26. 26

    DHCPD ip6、enp2s0のsubnet6宣言なし(2001:470:1f1a:5b3 :: 2)

  27. 27

    DHCPD ip6, No subnet6 declaration for enp2s0 (2001:470:1f1a:5b3::2)

  28. 28

    Enforce user time restrictions to log out or off from Windows 7

  29. 29

    Are log files written to when a buffer fills or in 'realtime'?

ホットタグ

アーカイブ