Help to understand WiFi connections

[ATraveller-73]

hello,

 

I recently installed Kaspersky and I’m trying to understand the functions provided.

In short, the WiFi monitor keeps showing that my television is connected, on both my phone and my computer, both of which are on the 5G network.

Looking through the details, I can see that the IP address and the MAC address are correct, but my TV should have all WiFi connections disabled.  Also, I’m seeing it as being online unrelated to whether the TV is online or not. Looking just at the router interface, it is connected to the Ethernet Interface, and is off when the TV is off etc. I can’t see it on the WiFi interface at all.

Out of curiosity, I did a tracert to the internal IP from the router interface, with the following results:

• traceroute to 192.168.0.18 (192.168.0.18), 30 hops max, 38 byte packets
• 1 10.116.9.1 (10.116.9.1) 29.620 ms 14.455 ms 11.558 ms
• 2 * * *
• 3 * * *
• 4 * * *
• 5 cpe.vlanif100.hinqa1.dk.customer.tdc.net (176.22.62.36) 45.835 ms !N
•  
• traceroute to 192.168.0.18 (192.168.0.18), 10 hops max, 38 byte packets
• 1 10.116.9.1 (10.116.9.1) 17.157 ms 13.234 ms 14.724 ms
• 2 * * *
• 3 * * *
• 4 ae18-100.hinqe10.dk.ip.tdc.net (176.22.62.36) 15.721 ms !N * *

 

After the second try (and after messing about a bit with other internal adresses on my LAN, which yielded only *** ressults), the tracert for IP *.18 stopped responding about 2-3 hops in, so I tried from a command prompt, and got the following:

• Tracing route to 192.168.0.18 over a maximum of 30 hops
•   1    10 ms     9 ms     9 ms  192.168.0.18
• Trace complete.
•  
• Tracing route to ae18-100.hinqe10.dk.ip.tdc.net [176.22.62.36]
• over a maximum of 30 hops:
•   1     8 ms     8 ms     8 ms  192.168.0.1
•   2    22 ms    23 ms    22 ms  10.116.9.1
•   3    18 ms    17 ms    17 ms  ae18-100.hinqe10.dk.ip.tdc.net [176.22.62.36]
• Trace complete.

Last but not least, every time I look into Kaspersky Cloud Security, it’ll tell me that the device is New, and Unknown.

I’m a complete beginner at this, learning as I go, so if someone could explain this to me, then I’d be really grateful. I’ve recently reset every electronic  device in the house due to prolonged upload issues (<1 Mbps), and things seem to be working ok, but I’ll admit that this worries me because I can’t understand what is going on.

[Igor Kurzin]

Hi @ATraveller-73, 

192.168.0.18 - is the internal IP of your PC or the TV? 

Is TV connected to the router via wire or only via wi-fi (when wi-fi connection is enabled)?

Which version of the Kaspersky Security Cloud are you using? 

Regards,

Igor

[ATraveller-73]

192.168.0.18     Sony TV     ac:9b:0a:XX:XX:XX     LAN 4
192.168.0.12     Laptop     E8:2A:44:XX:XX:XX     wl1

Yes, it’s the TV :)

After writing this post, I tried going through all interfaces to see if I’d forgotten anything after my factory reset. Only place I found a possible source of a WiFi signal was on the Screen Mirror input interface, which I then turned off.

This changed nothing.

I then set the IP of the TV to 192.168.0.16.

The IP changed in the Kaspersky cloud overview.

I then unplugged the ethernet cable from the router. Perhaps not surprisingly, this changed nothing.

I then turned off the TV, and unplugged it from the wall socket. This changed nothing, even after allowing time for the condensator to discharge.

The only thing the TV was connected to, besides the router, is a Nintendo Switch, via a HDMI cable. Could it have been tunnelling out through that one? The switch was marked as “incomplete” in the ARP table, which I’ve come to learn indicates that it’s offline (Although, I’ve seen the TV marked as “incomplete,” while still seeing an active ‘online’ signal in the 5G network analysis from Kaspersky) . Also, it wasn’t showing up in the Kaspersky “Devices in my Network,” so why would the TV be online via the Switch interface, while the switch is not?

At this point, I did a hard reset on the router. This changed nothing. I then had to wait about an hour, because the kid was online, and any further interference with the internet connection would have been very unpopular. But as soon as I could, I restarted the gateway, which promply ensured that I had no connection to the outside world. My WLAN looked fine though, and things came back online with new internal IPs. Not to mention that I was finally rid of the TV.

Yesterday, I was away the whole day, but today I just tried plugging the TV back into the router to see what happens. It promply came online, but now I can see it going offline as well when I unplug the ethernet cable, and refresh the Kaspersky interface. So I’m guessing this was some sort of a bug both in the software on both my mobile device and on the laptop? 

FYI, I’m running a paid version of Kaspersky, installed from the official homepage / google playstore this week, so I should hope that it’s fairly updated. It’s Kaspersky Security Cloud 21.1 on the Laptop.

BTW, can anyone tell me if there’s a way to download the logs from a router directly? I’m going crazy wading through 600++ pages of log entries 10 at a time via a browser interface, it’d be really nice to be able to have them in a .txt file.

Cheers.

[ElHombre]

any further interference with the internet connection would have been very unpopular. 

yeah, know what you mean, my kids start making noise when something happens with the Internet connection. 😀

It seems to have been some sort of glitch. It is hard to make any comments on the origins of this issue without having the tracelogs. If you ever come accross this situation we will need to gather some additional data for further analysis. 

As for the router - which model have you got? 

Regards,

Igor

[Igor Kurzin]

any further interference with the internet connection would have been very unpopular. 

yeah, know what you mean, my kids start making noise when something happens with the Internet connection. 😀

It seems to have been some sort of glitch. It is hard to make any comments on the origins of this issue without having the tracelogs. If you ever come accross this situation we will need to gather some additional data for further analysis. 

As for the router - which model have you got? 

Regards,

Igor

[ATraveller-73]

It’s a Sagemon FAST3890V3 ver. 3.

I think the software on it may have some vendor modifications, but I’m not sure. Just for kicks, I tried ssh admin@192.168.0.1, but got a timeout. Unfortunately, that’s about as far as my skills go, I’m at a loss as to what to try next (actually, I did try Telnet, but not surprisingly, that bombed).

As for logs, then I’ve had Glasswire running on the computer for about since the 15th of July, but I have no clue what I’m looking for. I’m probably at the stage where everything looks mighty suspicious - e.g. when I killed my internet connection two days ago, all of a sudden Kaspersky tells me that Lenovo.ImController is using the camera? Eh? I have no internet, maybe it’s trying to see what exactly I did to the router?

Anyways, cheers for the help!

Regards,

/A