Lan Access In Access Point Logs

[bjbgraphics]

Yesterday I installed a new D-Link DIR-628 on my network as a wireless access point. It is hardwired into my D-Link DGL-4300 and operates on its own IP on the same subnet mask as the rest of my network.

I enabled MAC Filtering on the D-Link DIR-628 and only allowed access to the computers on the network that need access to the computers connected to the access point or the access point itself (for administration).

I am seeing in the D-Link DIR-628 logs that the two computers that do not have access to the access point are trying to access it about every 4-12 minutes and I am just wondering why as there are no programs on either computer that need to communicate with the access point's IP.

[INFO] Sun Jun 29 11:09:31 2008 Access denied to LAN system with MAC address BBBBBBBBBBBB
[INFO] Sun Jun 29 11:07:25 2008 Access denied to LAN system with MAC address AAAAAAAAAAAA
[INFO] Sun Jun 29 11:07:16 2008 Above message repeated 1 times
[INFO] Sun Jun 29 10:57:30 2008 Access denied to LAN system with MAC address BBBBBBBBBBBB
[INFO] Sun Jun 29 10:55:25 2008 Access denied to LAN system with MAC address AAAAAAAAAAAA

Could this just be NetBIOS or some other function of TCP/IP on the accessing computers "feeling" out the rest of the network? I'm fairly certain that there is nothing malicious going on here but I'd like to stop the two computers from attempting access to the access point's IP as there would never be a need to do so.

BJB

[ephekt]

Could be ARPs or other broadcasts.

What are the actual MACs for those devices? Can you see the destination MAC, i.e., is it FFFFF... or the actual MAC of the AP?

[bjbgraphics]

I just moved the D-Link DIR-628 (access point) outside the DGL-4300's DHCP IP range. I didn't even know you could do this, and everything is working fine but I am still getting the MAC Addresses of the two MAC Restricted computers attempting access.

BJB

[bjbgraphics]

Perhaps ARP or other, but across the whole subnet? I actually just moved (see above) the access point outside the DHCP range of the router and the two computers are still trying to hit the access point IP.

The actual MACs for the two computers are the MAC Addresses of their network adapters. I cannot see the destination MAC of the attempt, only the MAC address of the adapter that it originated from.

BJB

Originally Posted by ephekt

Could be ARPs or other broadcasts.

What are the actual MACs for those devices? Can you see the destination MAC, i.e., is it FFFFF... or the actual MAC of the AP?

[ephekt]

That is weird. I'd fire up Wireshark and take a look at what's going on from the MACs in question.

Although, you're probably stressing over a silly issue.

[ephekt]

Perhaps ARP or other, but across the whole subnet?

A broadcast will reach every host in a broadcast domain, so if you have a flat network it is probably only delimited by the router at your edge.

[bjbgraphics]

Like I mentioned, I don't believe this issue has a malicious origin so I'm not under any real stress about it. I'd mostly just like to know what it is doing.

But thanks for the links and your posts. It is appreciated.

BJB

Originally Posted by ephekt

A broadcast will reach every host in a broadcast domain, so if you have a flat network it is probably only delimited by the router at your edge.

Originally Posted by ephekt

That is weird. I'd fire up Wireshark and take a look at what's going on from the MACs in question.

Although, you're probably stressing over a silly issue.