1
This issue came up during a routine check on my router/modem settings. Details follow.
I use a TP-Link TD-W8901N ADSL modem (specs here) facing the internet. The modem manages a 192.168.1.x subnet, on which the only other device is a Belkin WiFi router residing at 192.168.1.100. The Belkin router acts as a router/DHCP server and creates its own 192.168.2.x subnet, which is where all my devices actually reside. [1]
On the Belkin router, the gateway and DNS are correctly listed as the TP-Link modem (192.168.1.1), which itself is supposed to get the DNS details directly from the ISP (no fancy overrides from my side).
On the modem itself, I expected to find the DNS to be the ISP default, and the gateway to be 192.168.1.1.
However, the gateway points to 192.168.1.224 - and no device I know of exists at that IP on my home network.
Further, the routing table in the TP-Link management interface shows the following entries:
# Dest IP Mask Gateway IP Metric Device Use 1 192.168.1.224 32 192.168.1.224 1 poe7 0 2 192.168.1.0 24 192.168.1.1 1 enet0 5871511 3 default 0 Node8 2 poe7 6875620
Google tells me the "poe7" interface refers to a "Power over Ethernet" device, but I don't have any of that sort, and definitely no devices other than the modem and the router on the 192.168.1.x subnet.
Further the "Use" stat of 0 indicates that this interface has actually never been used, and may therefore just be some cruft left over from the default settings of the modem.
But to check what this device/poe7-interface could mean, I ran nmap on it, with the following results:
dummy-system~: nouser$ nmap 192.168.1.224
Starting Nmap 6.47 ( http://nmap.org ) at 2015-07-05 02:10 IST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.12 seconds
dummy-system~: nouser$ nmap -Pn 192.168.1.224
Starting Nmap 6.47 ( http://nmap.org ) at 2015-07-05 02:11 IST
Nmap scan report for 192.168.1.224
Host is up.
All 1000 scanned ports on 192.168.1.224 are filtered
Nmap done: 1 IP address (1 host up) scanned in 201.57 seconds
Which could in fact, mean that there is nothing at 192.168.1.224, as indicated by the original "0" Use Stat (which changed to "2" after running nmap twice), and bolster the "defaults cruft" theory. But this results in the following major inconsistencies:
- If there is nothing at the *.224 IP, then what is it doing in my gateway IP field, and how is any traffic being routed properly at all, if *.224 is not a valid gateway/device IP?
- And if it is a valid device or interface, why isn't nmap able to probe it better? Loading this IP directly in the browser also results in a "..the server where this page is located, is not responding" error.
Please help me understand this issue.
[1] I realize the setup maybe suboptimal - but it has worked quite well for me until now, and I'm reluctant to change that or go too far in messing with settings.