LinuxQuestions.org
Help answer threads with 0 replies.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 10-04-2022, 12:29 PM   #1
Completely Clueless
Member
 
Registered: Mar 2008
Location: Marbella, Spain
Distribution: Many and various...
Posts: 899

Rep: Reputation: 70
Question Suspicious Wireless Router Activity


Greetings everyone,

I've recently noticed the 'status lights' on my wireless router have been flickering when none of my wireless devices are switched on. I'm not one of those people who has all the latest gizmos with a wireless chip in everything I own. I have two mobile phones (cellphones for our American readers) one Apple Ipad, one tower system and various laptops. Yet when all of these were disabled, I noticed the lights flickering. It's the first time I've noticed this, but it could have been going on for years for all I know, as the router's not usually visible to me. The router's a Netgear DG834G and I've had it for several years now.
Should I be worried? I've never given the router password to anyone ever.
Thanks,
CC.

Last edited by Completely Clueless; 10-04-2022 at 06:56 PM.
 
Old 10-04-2022, 01:19 PM   #2
rtmistler
Moderator
 
Registered: Mar 2011
Location: USA
Distribution: MINT Debian, Angstrom, SUSE, Ubuntu, Debian
Posts: 9,883
Blog Entries: 13

Rep: Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930Reputation: 4930
Make sure you don't have a guest WiFi enabled.

Check the lights which are illuminating and determine from the device's documentation what their meaning is.
 
Old 10-04-2022, 01:35 PM   #3
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,665
Blog Entries: 4

Rep: Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945
Certain lights may "flicker" to indicate upstream Internet activity.

However, you should be careful to keep the router firmware up-to-date. (Enable "automatic updates" if these are available.) And, properly avail yourself of all hardware firewall features, in addition to software firewalls on the various pieces of client equipment. Most routers also contain logging features which are, for some reason, often not enabled. Turn them on for a while ...

Last edited by sundialsvcs; 10-04-2022 at 01:38 PM.
 
Old 10-04-2022, 02:17 PM   #4
metaed
Member
 
Registered: Apr 2022
Location: US
Distribution: Slackware64 15.0
Posts: 365

Rep: Reputation: 171Reputation: 171
I stopped breathing as Patrick struggled to get the plug lined up with the port. I stared at the front panel lights, and felt Dave doing the same. My eyes watered. Patrick pushed the plug in. The front lights immediately lit and flashed actively. I felt my hands and face flush, and out of the corner of my eye saw Dave sit up and open his mouth as if to speak. He then put his face down into his cupped hands, and threw up.
—Lawrence Kesteloot, "Coding Machines"
 
Old 10-04-2022, 02:38 PM   #5
teckk
LQ Guru
 
Registered: Oct 2004
Distribution: Arch
Posts: 5,140
Blog Entries: 6

Rep: Reputation: 1828Reputation: 1828Reputation: 1828Reputation: 1828Reputation: 1828Reputation: 1828Reputation: 1828Reputation: 1828Reputation: 1828Reputation: 1828Reputation: 1828
Capture all traffic on the LAN with tcpdump and see what it is. You'll need to do it on a wireless device with the interface in promiscuous mode.
Code:
ip link set eth0 promisc on
If it's on the WAN side. Block everything, and log it to the firewall log. See who it is.
 
Old 10-04-2022, 02:42 PM   #6
Emerson
LQ Sage
 
Registered: Nov 2004
Location: Saint Amant, Acadiana
Distribution: Gentoo ~amd64
Posts: 7,661

Rep: Reputation: Disabled
Well, if you live in a large private property with no neighbors like I do then yes, it might be suspicious. Is there a hacker with directional antenna, sitting a mile away in his car, targeting your access point, trying to steal that naked selfie from your LAN or phone for blackmail? OTOH, if your apartment is on a busy street with thousand people walking by, it might just be their phones are scanning for access points, causing your lights to flicker. Or it might be the aliens, trying to figure out how human communications work.
 
Old 10-04-2022, 03:16 PM   #7
elgrandeperro
Member
 
Registered: Apr 2021
Posts: 415
Blog Entries: 2

Rep: Reputation: Disabled
First, if you can get on your router you can see what devices are connected by macid. You can use the macid to get what approximate device is connected.

https://aruljohn.com/mac.pl

Sometimes you can only see some cheap network card, however. But with so few devices, you should be able to figure out each device, every device has a way to find out the wifi macid.
 
1 members found this post helpful.
Old 10-04-2022, 03:29 PM   #8
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,727

Rep: Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919
Which light(s) on the router are flickering? As posted internet activity does not mean necessarily that something nefarious is going on. My router detects lots of WAN incoming traffic but most of that is blocked from every getting through to the LAN.

Were any of the LAN lights blinking? You did not mention if you have wired devices and/or if they were running.
 
Old 10-04-2022, 05:27 PM   #9
Completely Clueless
Member
 
Registered: Mar 2008
Location: Marbella, Spain
Distribution: Many and various...
Posts: 899

Original Poster
Rep: Reputation: 70
Unhappy

Quote:
Originally Posted by teckk View Post
Capture all traffic on the LAN with tcpdump and see what it is. You'll need to do it on a wireless device with the interface in promiscuous mode.
Code:
ip link set eth0 promisc on
If it's on the WAN side. Block everything, and log it to the firewall log. See who it is.
I had to install tcpdump which got to 71% then threw up a dialogue box saying grub needed to be upgraded and which partition to do it with. I didn't fancy meddling with grub and making the system unbootable so I'm afraid the steps you suggested, though certainly logical and sensible, are not something I can currently implement. Thanks anyway.
 
Old 10-04-2022, 05:40 PM   #10
Completely Clueless
Member
 
Registered: Mar 2008
Location: Marbella, Spain
Distribution: Many and various...
Posts: 899

Original Poster
Rep: Reputation: 70
Thanks for all the suggestions, guys. I'm afraid (as my screen name alludes) I'm not very technical; especially so with IP stuff. Plus I've moved house since I bought the router and have lost the box and instructions, so can't tell what the various lights indicate. For the same reason I can't interrogate the device to see what settings are currently in place, nor change them if they're unsatisfactory. So I think perhaps the best thing to do is just buy a new one with maybe better security. The current one is getting on for 10 years old which is a lifetime in tech terms so it's probably time for an upgrade anyway.
I'm not bothered about people stealing my bandwidth (within reason!) but the possibility that some perv might be viewing child porn and I might end up in the frame for it is something I really cannot live with, as I'm sure none of you would, either.
Any other thoughts?
 
Old 10-04-2022, 06:03 PM   #11
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,727

Rep: Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919
Pick your version.

https://www.netgear.com/support/product/DG834Gv3.aspx
 
Old 10-04-2022, 06:25 PM   #12
Completely Clueless
Member
 
Registered: Mar 2008
Location: Marbella, Spain
Distribution: Many and various...
Posts: 899

Original Poster
Rep: Reputation: 70
Quote:
Originally Posted by michaelk View Post
Is that really the best out there? Given that these things aren't very expensive, I'm thinking maybe get a new dual-band one which is Linux friendly and has a fully-configurable user-interface. If anyone knows such a device, I'm in the market for it.
 
Old 10-04-2022, 06:46 PM   #13
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,727

Rep: Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919
Nope, I was just responding that you did not know what the lights represent and posting a link to the manual but not something new to purchase. I have cable versus ADSL so not up on the latest nor what is available/compatible in your area.

Depends on how much money you want to spend to get the latest and greatest wifi.
 
1 members found this post helpful.
Old 10-04-2022, 06:59 PM   #14
Emerson
LQ Sage
 
Registered: Nov 2004
Location: Saint Amant, Acadiana
Distribution: Gentoo ~amd64
Posts: 7,661

Rep: Reputation: Disabled
I have cable modem, router, switch and access point. All separate units, and this is the way I like it. I can replace any of them if a reason arises, without touching the others.
 
Old 10-04-2022, 07:23 PM   #15
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,727

Rep: Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919Reputation: 5919
As far as I know ADSL MODEMs are more common in gateway devices i.e. combination MODEM/router then separate standalone devices. Your ISP should have a list of compatible devices.

You may have faster Internet speeds then your old MODEM provides which is a good incentive to purchasing a new device. Many have the capability of bridge mode which basically bypasses the builtin router/wifi functionality. You can then use any "regular" router with an Ethernet WAN port.

I also have all separate units.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Does IPCop act on Suspicious Activity gizza23 Linux - Security 8 09-27-2007 03:35 PM
Keep track of logs to find suspicious activity leosgb Linux - Security 3 03-04-2006 06:09 PM
Suspicious hard drive activity machinemanagement Red Hat 4 08-25-2005 03:28 PM
suspicious log activity hoedad Linux - Newbie 3 07-26-2004 07:33 AM
Stopping suspicious ICMP activity tarballedtux Linux - Security 1 02-03-2002 07:11 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 01:04 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration