Does this message mean someones tries to hack my router?

2

I got 8level router and in System tools > System logs I got 15 messages like this in the last hour:

wlan0: A wireless client (A0:6C:EC:BE:7C:2F) was rejected due to access control for 16 times in 5 minutes

What is even more strange, I don't have ANY messages before 1 hour and my router logs events like: wlan0: A wireless client is associated - F8:DB:7F:78:DC:8D. First message when I looked up was about rejecting client due to access control, just at the time what I opened System logs. It look like router start logging messages freshly after my visit to this tab...

UPDATE

My router model is 8level WRT-150A

user1853195819

Posted 2012-08-07T22:45:23.060

Reputation: 21

FYI, A0:6C:EC:BE:7C:2F is a MAC address for a Blackberry and F8:DB:7F:78:DC:8D is a MAC address for an HTC phone - have any of those in your house? See http://hwaddress.com/?q=A0%3A6C%3AEC%3ABE%3A7C%3A2F and http://hwaddress.com/?q=F8%3ADB%3A7F%3A78%3ADC%3A8D

– shf301 – 2012-08-08T01:31:33.340

Answers

2

(A0:6C:EC:BE:7C:2F)

That is the MAC address of someone that attempted to connect to your router (wirelessly I'm guessing). It doesn't mean they tried to "hack" it, it just means they selected your SSID when the list of wireless network names appeared. Most routers have a way to make the network name anonymous (not show up). This will make it a little more difficult for people to find it (not impossible) and will stop this alert from showing up.

It is likely they couldn't connect because you enabled security to block or allow connections based on the MAC address.

If you post the router make and model I'll see if I can find a screen shot that shows where to make the changes I'm recommending.

Everett

Posted 2012-08-07T22:45:23.060

Reputation: 5 425

Yes, I enabled filtering by MAC address. My router is 8level WRT-150A. – user1853195819 – 2012-08-07T23:04:09.217

I couldn't find a picture, but what you want to do is disable the SSID broadcast. You'll likely find it in your configuration (it may be a security feature). This means that in order for someone to connect to your wireless network, they will need to enter the SSID (the network name) of your wireless network in their device (computer, phone, etc...) – Everett – 2012-08-07T23:11:50.797

There is an instruction manual here: https://encrypted.google.com/url?sa=t&rct=j&q=8level%20wrt-150a%20stop%20ssid%20broadcast&source=web&cd=2&sqi=2&ved=0CGQQFjAB&url=http%3A%2F%2F8level.pl%2Findex.php%3Fpage%3Dshop.getfile%26file_id%3D100%26product_id%3D11%26option%3Dcom_virtuemart%26Itemid%3D2%26lang%3Dpl&ei=DqEhUKC0J4_RqAGLrIGYBA&usg=AFQjCNFzDoDVASRvzjjEDhDOfiAFit2zDA

– Everett – 2012-08-07T23:14:13.680

Now I got this message: klogd started: BusyBox v1.00-pre8 (2005.09.16-02:17+0000) is it ok? – user1853195819 – 2012-08-08T00:37:54.770

Right after disabling broadcasting SSID. – user1853195819 – 2012-08-08T00:38:32.007

After disabling broadcasting SSID I don't get more messages. I enabled SSID broadcasting and I again get messages. Now I left it disabled and check logs later. Thank you for help. – user1853195819 – 2012-08-08T01:08:23.640

Just count it answered when your convinced, that's all I ask. – Everett – 2012-08-08T02:04:24.350

I can't - it's still here: Aug 8 11:14:03 wlan0: A wireless client was rejected due to access control - A0:6C:EC:BE:7C:2F – user1853195819 – 2012-08-08T09:18:40.140

Make sure the broadcast is off, then change the name of the network. The person trying to connect may be the same person that had the name of your network (before you stopped broadcasting it). The other thing to remember is, this isn't perfect. I have tools that will show me the name of networks, even if they aren't broadcasting it. This is just telling you that the security precaution you put in place (MAC locking it) did its job. Your network isn't being "hurt" in any way. Good work. – Everett – 2012-08-08T13:10:46.387

Asked: 2012-08-07T22:45:23.060

Viewed: 3 993 times

Active: 2012-08-07T23:09:48.443