Just how worried should I be about an attempted connection to my wireless network?

I've just installed a modest home network (2 desktops via ethernet and a
laptop via wireless 11g card, on a USR 8054 with a cable router internet
connection). I've been reading the threads on this group about enabling
encryption and other security measures and intend to do something as soon as
I can make my way through the series of seemingly random screens, menus,and
submenus that pass for USRobotics documentation.

My router log listed a series of messages that read "Unauthorized wireless
PC try to connected" (that's not a typo), with a MAC address not my own. I
did enable access only for my own MAC addresses (I know that's not
sufficient, but seemed like a logical first step).

My question is this: Is this somebody who is actively trying to get into my
network, or is this something that happens routinely whenever a neighbor is
using his or her own wireless setup? In other words, should I be even more
concerned about security because here is evidence that somebody is trying to
gain access, or is this just a benign, common occurrence? For example, is
my wireless card always searching for other available wifi setups, even
after it has connected with my own?

And is there any way I can send a message to the intruder that I'm on to him
(without enabling him temporary access to be malevolent)?

Thanks

If the unauthorized person is constantly trying to get in then I might
do more for security but a one time thing wouldn't bother me, as long
as they didn't actually get in! I sent my son with his laptop from
home to college and he found about 50 places that showed up on
NetStumbler, it's only about a 2 hour drive. Now not all could have
been accessed, some had encrytion, etc. but quite a few didn't. It is
called "war driving". I DO NOT ever try to get in where I am not
supposed to, but there are a lot of people out there with wireless
systems!

On Sat, 17 Jan 2004 21:19:55 GMT, "MBK" <(E-Mail Removed)> wrote:

>I've just installed a modest home network (2 desktops via ethernet and a
>laptop via wireless 11g card, on a USR 8054 with a cable router internet
>connection). I've been reading the threads on this group about enabling
>encryption and other security measures and intend to do something as soon as
>I can make my way through the series of seemingly random screens, menus,and
>submenus that pass for USRobotics documentation.
>
>My router log listed a series of messages that read "Unauthorized wireless
>PC try to connected" (that's not a typo), with a MAC address not my own. I
>did enable access only for my own MAC addresses (I know that's not
>sufficient, but seemed like a logical first step).
>
>My question is this: Is this somebody who is actively trying to get into my
>network, or is this something that happens routinely whenever a neighbor is
>using his or her own wireless setup? In other words, should I be even more
>concerned about security because here is evidence that somebody is trying to
>gain access, or is this just a benign, common occurrence? For example, is
>my wireless card always searching for other available wifi setups, even
>after it has connected with my own?
>
>And is there any way I can send a message to the intruder that I'm on to him
>(without enabling him temporary access to be malevolent)?
>
>Thanks
>

MBK wrote:

> My question is this: Is this somebody who is actively trying to get into
> my network, or is this something that happens routinely whenever a
> neighbor is
> using his or her own wireless setup? In other words, should I be even
> more concerned about security because here is evidence that somebody is
> trying to
> gain access, or is this just a benign, common occurrence? For example, is
> my wireless card always searching for other available wifi setups, even
> after it has connected with my own?

If it's an occasional occurance, it's probably not worth worring about. If
persistent, then you may have someone trying to break in. A wireless card
will scan for available networks and can display them to you, so you can
connect.

On my own network, I have both 128 bit enabled and require a VPN, to get
past my firewall.

--

Fundamentalism is fundamentally wrong.

To reply to this message, replace everything to the left of "@" with
james.knott.

On Sat, 17 Jan 2004 21:19:55 GMT, "MBK" <(E-Mail Removed)> wrote:



>
>My question is this: Is this somebody who is actively trying to get into my
>network, or is this something that happens routinely whenever a neighbor is
>using his or her own wireless setup? In other words, should I be even more
>concerned about security because here is evidence that somebody is trying to
>gain access, or is this just a benign, common occurrence? For example, is
>my wireless card always searching for other available wifi setups, even
>after it has connected with my own?
>
>And is there any way I can send a message to the intruder that I'm on to him
>(without enabling him temporary access to be malevolent)?

Is the intruder a "normal" mac address or one with a lot of repeated
numbers? There is something in Windows which occasionally produces
traffic like this. The clue is in the logs, you can see that the
access was associated with something one of your network machines did.
E.g. you checked newsgroups and one of those macs is logged as making
an NNTP connection at that time.

--
Niall

turn off ssid broadcast, and restrict access to your mac addresses (which i
think you already did). This is far better security than wep keys , although
you could enable that as well if you are really paranoid.

It seems that every time i turn on my pc it polls all of my access points,
so i dont believe what you are seeing would necessarily have to be malicious
activity.

"MBK" <(E-Mail Removed)> wrote in message
news:%FhOb.73815$Rc4.261022@attbi_s54...
> I've just installed a modest home network (2 desktops via ethernet and a
> laptop via wireless 11g card, on a USR 8054 with a cable router internet
> connection). I've been reading the threads on this group about enabling
> encryption and other security measures and intend to do something as soon
as
> I can make my way through the series of seemingly random screens,
menus,and
> submenus that pass for USRobotics documentation.
>
> My router log listed a series of messages that read "Unauthorized wireless
> PC try to connected" (that's not a typo), with a MAC address not my own.
I
> did enable access only for my own MAC addresses (I know that's not
> sufficient, but seemed like a logical first step).
>
> My question is this: Is this somebody who is actively trying to get into
my
> network, or is this something that happens routinely whenever a neighbor
is
> using his or her own wireless setup? In other words, should I be even
more
> concerned about security because here is evidence that somebody is trying
to
> gain access, or is this just a benign, common occurrence? For example, is
> my wireless card always searching for other available wifi setups, even
> after it has connected with my own?
>
> And is there any way I can send a message to the intruder that I'm on to
him
> (without enabling him temporary access to be malevolent)?
>
> Thanks
>
>

Thanks for your reply. If anything, I am more concerned than ever. Here's
what I have done:


1. disabled the WAN part of the router
2. turned off SSID broadcast
3. changed the SSID from the default name to a new one
4. restricted access to my own mac addresses
5. changed the configuration on my laptop to search for the new SSID name

Then, I re-enabled the WAN. My own laptop successfully connected. Almost
immediately, though, I started getting the same "Unauthorized wireless PC
try to connected" message. This would repeat, at first, about once every 15
seconds. That was a couple of days ago. I left the WAN disabled for two
days. I enabled it again today and, as soon as I did, I started getting the
"unauthorized PC..." message, and the log indicated these attempts were
happening every second. I know this is not my own laptop attempting to
connect, because it was not even on at the time. Further, I looked up the
offending mac address at on online mac id site, and it was identified as a
Netgear card, and my brand is U S Robotics.

So, then I tried enabling WEP encryption (64-bit at first, then 256-bit).
I'm pretty sure I was doing it correctly, since I couldn't connect with my
own laptop until I put the key in that config also. Again, I continued to
get the "unauthorized wireless PC" message. Would I still be getting that
message if it's a casual attempt? I didn't get that message when my OWN
laptop couldn't connect (before I put the encryption key in).

So.... are the paranoids really after me?



"Mike Clay" <(E-Mail Removed)> wrote in message
news:IcAPb.206366$JQ1.61982@pd7tw1no...
> turn off ssid broadcast, and restrict access to your mac addresses (which
i
> think you already did). This is far better security than wep keys ,
although
> you could enable that as well if you are really paranoid.
>
> It seems that every time i turn on my pc it polls all of my access points,
> so i dont believe what you are seeing would necessarily have to be
malicious
> activity.
>
> "MBK" <(E-Mail Removed)> wrote in message
> news:%FhOb.73815$Rc4.261022@attbi_s54...
> > I've just installed a modest home network (2 desktops via ethernet and a
> > laptop via wireless 11g card, on a USR 8054 with a cable router internet
> > connection). I've been reading the threads on this group about enabling
> > encryption and other security measures and intend to do something as
soon
> as
> > I can make my way through the series of seemingly random screens,
> menus,and
> > submenus that pass for USRobotics documentation.
> >
> > My router log listed a series of messages that read "Unauthorized
wireless
> > PC try to connected" (that's not a typo), with a MAC address not my own.
> I
> > did enable access only for my own MAC addresses (I know that's not
> > sufficient, but seemed like a logical first step).
> >
> > My question is this: Is this somebody who is actively trying to get
into
> my
> > network, or is this something that happens routinely whenever a neighbor
> is
> > using his or her own wireless setup? In other words, should I be even
> more
> > concerned about security because here is evidence that somebody is
tryingempt
> to
> > gain access, or is this just a benign, common occurrence? For example,
is
> > my wireless card always searching for other available wifi setups, even
> > after it has connected with my own?
> >
> > And is there any way I can send a message to the intruder that I'm on to
> him
> > (without enabling him temporary access to be malevolent)?
> >
> > Thanks
> >
> >
>
>