Router knows it all?

Router knows it all?

NewsGroups | Search | Tools
 comp.dcom.lans.ethernet  Post an article  get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content  add this group's latest topics to your Google content  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Router knows it all? =?iso-8859-1?q?Tom=E1s_=D3_h=C 01-14-2008
Posted by =?iso-8859-1?q?Tom=E1s_=D3_h=C on January 14, 2008, 10:32 am
If you were  Registered and logged in, you could reply and use other advanced thread options


I have broadband internet at home. The WAN port on my router has a
public address, and all the hosts on my LAN have private addresses. The
router performs NAT so that we can all access the internet (well over
TCP and UDP anyway).

Anyway, my router has a built-in HTTP daemon which provides a web
page for configuring the router. When I go into "LAN statistics", it
tells me what hosts are on my LAN. It tells me their IP address, their
MAC address, and their host name.

First thing I'm curious about is how the router knows what's sitting
on the LAN. My first thought was that maybe it just looks at the DHCP
leases it has given out, but then I tried configuring one host's IP
address manually and it still came up in the host list.

Another thought I had was that maybe it just pings all the addresses
in the network address range. Only problem here though is that my
address range is 10.0.0.0/8, so it would have to ping about 16 million
hosts, and I doubt that that's what it's doing.

Another thought I had was that maybe it looks at the MAC address
table in its internal switch?

Does anyone know a home broadband internet router typically
determines what hosts are on the LAN?

My second question pertains to how a computer knows whether there's
an ethernet cable plugged into the NIC (i.e. how it knows that it's on a
LAN). For instance, in Windows, I have a little icon in the bottom right
corner; the icon is two little machines, and it represents my NIC
network connection. When there's no ethernet cable plugged in, there's
an X through the icon. When I plug a cable in (e.g. a cross-over between
two laptops), then all of a sudden the X disappears and it instantly
knows it's on a LAN. How is this? Also, after a second or two, it pops
up a little balloon box saying whether it's 10 or 100 Mbps. Again, how
does it know this?

Last thing I want to ask about is the host name. How does it get the
hostname (e.g. "family-pc" or "laptop-james")? Is there some sort of
layer 2 or layer 3 protocol for getting a host's name? Does anyone know
a way of intercepting the hostname request in Windows?

--
Tomás Ó hÉilidhe

Network Magic Graduation 20% off animated banner
Posted by Intuitive on January 15, 2008, 2:32 am
If you were  Registered and logged in, you could reply and use other advanced thread options


Tomás Ó hÉilidhe wrote:
>
> I have broadband internet at home. The WAN port on my router has a
> public address, and all the hosts on my LAN have private addresses. The
> router performs NAT so that we can all access the internet (well over
> TCP and UDP anyway).
>
> Anyway, my router has a built-in HTTP daemon which provides a web
> page for configuring the router. When I go into "LAN statistics", it
> tells me what hosts are on my LAN. It tells me their IP address, their
> MAC address, and their host name.
>
> First thing I'm curious about is how the router knows what's sitting
> on the LAN. My first thought was that maybe it just looks at the DHCP
> leases it has given out, but then I tried configuring one host's IP
> address manually and it still came up in the host list.

Each packet that goes through the Router, contains a source IP address
inside it. Therefore, each time a Computer tries to send data through
your Router; the Router is made aware of that Computer.

>
> Another thought I had was that maybe it just pings all the addresses
> in the network address range. Only problem here though is that my
> address range is 10.0.0.0/8, so it would have to ping about 16 million
> hosts, and I doubt that that's what it's doing.
>
> Another thought I had was that maybe it looks at the MAC address
> table in its internal switch?
>

Quite possibly.

> Does anyone know a home broadband internet router typically
> determines what hosts are on the LAN?

Depends on the company which made the Router. Each company might use
different methods.

>
> My second question pertains to how a computer knows whether there's
> an ethernet cable plugged into the NIC (i.e. how it knows that it's on a
> LAN). For instance, in Windows, I have a little icon in the bottom right
> corner; the icon is two little machines, and it represents my NIC
> network connection. When there's no ethernet cable plugged in, there's
> an X through the icon. When I plug a cable in (e.g. a cross-over between
> two laptops), then all of a sudden the X disappears and it instantly
> knows it's on a LAN. How is this?

The NIC detects the presence of electricity flowing through it. What a
miracle :-)
Next, Windows notifies you (graphically) that the network card is no
longer receiving electricity from a network cable.

Also, after a second or two, it pops
> up a little balloon box saying whether it's 10 or 100 Mbps. Again, how
> does it know this?

Auto-negotiation. It's a feature of network cards which determines the
highest possible speed available, using the speed of both ends of the
cable link.

>
> Last thing I want to ask about is the host name. How does it get the
> hostname (e.g. "family-pc" or "laptop-james")?

Because a NetBIOS name has been set on each of these Computers.

Is there some sort of
> layer 2 or layer 3 protocol for getting a host's name?

Yes, it's called NetBIOS. It stands for Network Basic Input Output
System. Microsoft created it.

Does anyone know
> a way of intercepting the hostname request in Windows?


You can intercept the request by reading it with a type of program
called a Port Sniffer.

If you wish to block these requests, then you can do so by setting up
firewall rules to block NetBIOS traffic. If you use your research skills
here, then you'll be able to find which TCP or UDP ports NetBIOS uses :-)


Posted by =?iso-8859-1?q?Tom=E1s_=D3_h=C on January 15, 2008, 6:58 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Intuitive:

> The NIC detects the presence of electricity flowing through it. What a
> miracle :-)
> Next, Windows notifies you (graphically) that the network card is no
> longer receiving electricity from a network cable.


Let's say we've got two laptops with NIC cards. If you stick a
cross-over cable between the two of them, then they istantly know that
they're on a LAN and the X disappears over the icon.

Obviously one way of knowing your on a LAN is just by putting a volt
meter across the ethernet port and seeing if there's any traffic. But
I'm talking about a situation where there was no prior communication
between the two laptops, so neither of them should have been
transmitting. Yet still, they know instantly that they've been connected
to another machine.


> You can intercept the request by reading it with a type of program
> called a Port Sniffer.
>
> If you wish to block these requests, then you can do so by setting up
> firewall rules to block NetBIOS traffic. If you use your research
> skills here, then you'll be able to find which TCP or UDP ports
> NetBIOS uses :-)


I've done a port scan on my machine from within the LAN. I've got two
open ports, 21 (ftp) and 3389 (Remote Desktop). Note that I don't have
either of 137,138,139,445 open. So how's the router getting my
computer's name. . . ?

--
Tomás Ó hÉilidhe

Posted by Jerry Peters on January 15, 2008, 4:23 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> Intuitive:
>
>> The NIC detects the presence of electricity flowing through it. What a
>> miracle :-)
>> Next, Windows notifies you (graphically) that the network card is no
>> longer receiving electricity from a network cable.
>
>
> Let's say we've got two laptops with NIC cards. If you stick a
> cross-over cable between the two of them, then they istantly know that
> they're on a LAN and the X disappears over the icon.
>
> Obviously one way of knowing your on a LAN is just by putting a volt
> meter across the ethernet port and seeing if there's any traffic. But
> I'm talking about a situation where there was no prior communication
> between the two laptops, so neither of them should have been
> transmitting. Yet still, they know instantly that they've been connected
> to another machine.

There's a defined pattern that's sent on an idle link so that the
status of the connection can be determined. This is obviously
necessary for autonegotiation to work.

        Jerry

Similar ThreadsPosted
I have PC->Router->DSL Modem->ISP, Does ISP Router learn the PC MAC address? April 25, 2005, 6:33 am
ADSL Router connected to another router problem September 28, 2006, 3:34 am
connecting Cisco router to Juniper router via e1 September 24, 2007, 6:18 am
is a NAT device/'home router' - a router? September 27, 2005, 8:10 pm
Problem: 2 ISP, 1 router, 1 modem, 1 modem/router September 20, 2006, 10:14 am
Cannot run behind router December 11, 2007, 11:54 pm
Linsys Router Behind T1 April 18, 2005, 10:06 am
"Seeing" both ways across router? November 1, 2005, 5:47 pm
ethernet router March 1, 2006, 10:10 am
Help! need router rcommendation March 10, 2006, 6:26 am

other useful resources:
The Federal Communications Commission (FCC)
Telecommunications Industry Association
Electronic and Software Security Products and Services
International Telecommunication Union

Custom CGI Perl and PHP programming by 1-Script.com

Contact Us | Privacy Policy
The site map in XML format XML site map