Spurious Logons From Within Home Network.

[molimelight]

I've been getting seeming random logons from an IP address that is close to the ones I use on my home network. It logs in as me and only stays for a minute or so at the most before logging out. I use static IP's and IP MAC binding for all of my hard wired network in my router and it doesn't match any of the IP addresses I have in there and I use MAC filtering in my AP. The DHCP (Have to have as I can't set static IP in phone or Kindle) client list in the wireless AP shows only the two MAC addresses for my phone and for my Kindle Fire. It seems as though it's something that BI is generating rather than actually coming in over the network. Any ideas?

 

[Tolting Colt Acres]

Someone has hacked your wireless AP password and simply statically-assigned themselves an IP address on your subnet.

How is your AP configured, security-wise?

 

[molimelight]

Someone has hacked your wireless AP password and simply statically-assigned themselves an IP address on your subnet.

How is your AP configured, security-wise?

Thanks for the input, but I don't think that's it. I have a high speed bridge between my house and the shop that I use to survey any other AP/Routers in the area (fairly rural area) and the only two that come up have such a weak signal that I don't think they could even connect successfully to my AP. Just to be sure, though, I have put their MAC addresses into my wired router to block them. Whenever I've checked the client list in my AP the only MAC addresses listed match my cel phone and Kindle Fire. I've never seen anything else in there that shouldn't be. My AP security is WPA-2 Mixed with pre shared key/passphrase. I've even put the IP address of the spurious log on in my wired router to block it on all ports from 1 to 8000 plus and changed my password and it still logs on as me from that IP address. When I try and ping that address I get nothing. That's why I say it seems as though it's something Blue Iris is doing.

 

[Tolting Colt Acres]

I've never seen BI "create" an IP address out of thin air. It would have to be an IP address assigned, somehow, to the BI server if BI were generating what you see.

I would capture the MAC addresses associated with the "spurious logins" and then see who the manufacturer of the nic is, for starters.

 

[molimelight]

Boy do I feel like a dummy. The culprit was my cel phone. My AP was assigning it the IP address I was seeing on the logins and the BI Companion app for Windows Phone was updating the tile every so often. When I was testing it I changed the IP address range for the DHCP in the AP and it next logged on with one in that range. I also found that when I logged on with the BI Companion app on the phone it would remain logged in after I closed the app so I went in and changed the ability of that app to run in the background. I think that will take care of it. Thanks for your assistance "Colt"!

 

[Mr White]

Thanks for posting the problem and solution.. good to know