Someone trying to guess router password?

[jlevi]

Hello all,

I had to get a new router so I bought a cisco/Linksys BEFSX41 for our small company (Less than 20 people) It is a real estate office so people come and go all day.

I was checking out the logs and noticed that there were a lot of password attempts to login to the router. They are usually in the middle of the night when no one is there, yet they are coming from an internal IP 192.168.1.109 - So far the attempts are unsuccesseful but I am wondering who this is guessing the password? There is no x.x.x.109 on my local network as I have everyone hard-coded in the 50-100 range.

I checked the DHCP log and there was a mac address with no name assigned to 109, the mac address belongs to Asustek. I added that mac address to the restrict access list in the router hoping that would slow whoever is doing this down inside my local network.

Any ideas on other ways I can see what is going on?

WoAH! Red alert, in the time I have typed this I double checked the log and found..

2005-12-10 09:59:07 Web login successfully from 192.168.1.109

How can I find who this is? they are coming in from outside!

 

[flashes24]

you should do a trace on the ip. An easy way to see if it is an outside source, stop all activity to and from the net overnight, and see if it still happens. I've had the same thing come up before at my last company, come to find out it was a printer sending out a signal to make sure it was still connected to the network, so I turned off this property on the printer and it solved my problem.