Page 2 of 3
Posted: Fri May 25, 2007 9:27 pm
by techjunkie
What concerns me most is how "the heck" the DHCP entry can exist at all...
I have UPnP switched off and the MAC filter turned on. If I try to connect with any other device that aren't in the "allowed MAC table", they can't get an address. Why does this get an address? So even if there was a rootkit with some virtual NIC, it shouldn't be able to connect to the network.
I begin to suspect that it is some kind of RAS settings on XP or some "router internal stuff".
I'll dig deeper my dear Watson!

Posted: Fri May 25, 2007 11:12 pm
by DoubleDutch
Try disabling the onboard network card in the bios or removing it if its a plugged in one and plug in a new network card - see if it disappears then?
Posted: Sat May 26, 2007 12:14 am
by Derek
This might be a solution, tells you how to disable the ras server (or at least how to deny it access)
http://www.southwestern.edu/ITS/netreg/ ... /0320.html
Posted: Sat May 26, 2007 12:38 am
by techjunkie
DoubleDutch wrote:Try disabling the onboard network card in the bios or removing it if its a plugged in one and plug in a new network card - see if it disappears then?
I can try that, but it wouldn't make a differens, because with the same WinXP installation on another hardware I get the same results.
Posted: Sat May 26, 2007 12:42 am
by techjunkie
I did thought about that too, but I haven't any RAS service active?!?

Posted: Sat May 26, 2007 12:46 am
by techjunkie
One solution would to be "install another XP installation", but I think that would be "to go around the problem", not to solve the problem...

and that's not "my kind of thinking"!!
[EDIT]
I MUST be in control over my hardware! The Techjunkie has spoken...

Posted: Sat May 26, 2007 2:49 am
by Rook Zimbabwe

We used to use the MAC address list, but since MAC addreses are easily spoofed and MAC addresses are freely given by your wireless device when asked... we use encryption and a password. Safest.
Change your setup.
Posted: Sat May 26, 2007 7:10 am
by DoubleDutch
It's best to use MAC # as well as password/encryption and hide SSID. Also TURN OFF wireless if not in use.
Posted: Sat May 26, 2007 2:48 pm
by techjunkie
Rook Zimbabwe wrote:
We used to use the MAC address list, but since MAC addreses are easily spoofed and MAC addresses are freely given by your wireless device when asked... we use encryption and a password. Safest.
Change your setup.

Of course I use encryption (WPA-PSK) AND password AND MAC filter... It would be very stupid to use only MAC filter, but I'll guess encryption with passwords AND MAC filter are more secure than encryption and passwords only - it should be, you add one more security setting.
and yes, we need the WiFi. We use it on all Laptops at home.
Posted: Mon May 28, 2007 12:38 am
by techjunkie
Well, mystery solved!

It was a RAS related "thingy", but very strange though - I never seen a RAS service create a DHCP entry before, not at work or home. The strange thing is that with two other "ground installations" of Win XP Pro, the same service don't create an entry.
Well, now when I know what it was - I wipe that partition and install a fresh XP again.
Thanks for all help!

Posted: Mon May 28, 2007 12:50 am
by Derek
Glad to see you are back "in control over your hardware!"

A little off topic but still router related....
Posted: Mon May 28, 2007 2:36 pm
by Tipperton
I used to use a D-Link DI-604 router.
Lately I noticed that my Internet connection seemed rather sluggish all the time and seemed to have a lot of lost packets.
On a whim I disconnected the router and turned on XP's built-in firewall which I had disabled; two firewall's isn't necessary and is just a waste of system resorces IMHO.
Surprize!
My Internet connection suddenly got a whole lot faster and seemed a lot more reliable (a lot fewer lost packets) and has stayed that way. Just to be sure I re-connected the router and the Internet connection slowed down again, didn't keep it connected to see if the lost packets problem came back but at this point, I'm betting it would have.
So....
If I decide I need a router again, I'll have to find one that can handle the speed of my Internet connection.
For now, no router and using XP's built-in firewall works for me....
This one will go on eBay....

Posted: Mon May 28, 2007 4:34 pm
by techjunkie
Derek wrote:Glad to see you are back "in control over your hardware!"

Thanks, well not in total control... *L* I'm just dissecting the RAS service, to see if it is altered in some way.
Re: A little off topic but still router related....
Posted: Mon May 28, 2007 6:41 pm
by techjunkie
Tipperton wrote:I used to use a D-Link DI-604 router.
Lately I noticed that my Internet connection seemed rather sluggish all the time and seemed to have a lot of lost packets.
On a whim I disconnected the router and turned on XP's built-in firewall which I had disabled; two firewall's isn't necessary and is just a waste of system resorces IMHO.
Surprize!
My Internet connection suddenly got a whole lot faster and seemed a lot more reliable (a lot fewer lost packets) and has stayed that way. Just to be sure I re-connected the router and the Internet connection slowed down again, didn't keep it connected to see if the lost packets problem came back but at this point, I'm betting it would have.
So....
If I decide I need a router again, I'll have to find one that can handle the speed of my Internet connection.
For now, no router and using XP's built-in firewall works for me....
This one will go on eBay....

I had a DI-604 before too - I went back to the store with it after three days because of packet loss. Also the thruput of the router couldn't manage the 100 Mbit full duplex connection I had at the time (real fiber).
The same goes for many firewalls. I did a test, how much I did loose in thruput with different firewalls. ZoneAlarm and Norton was miserable. With Norton my speed went down from my 100 Mbit to approximately 30 Mbit.
The only firewalls (at that time) that could manage my speed without almost any loss, where BlackICE and Sygate Personal Firewall.
Re: A little off topic but still router related....
Posted: Tue May 29, 2007 1:46 am
by Tipperton
techjunkie wrote:The only firewalls (at that time) that could manage my speed without almost any loss, where BlackICE and Sygate Personal Firewall.
Wow!
BlaceICE was the first firewall program I ever used and I used it for a long time until I got my first router with a built-in firewall. By the time I sold off the router because I no longer needed it, I was using XP so I just switched to it's firewall.
It seems to work quite well so I don't see any reason to buy some other firewall program. Not to mention that most of the other firewall programs seemed to cause more problems than they were supposed to solve....