[SOLVED] Invisible Wireless Intruder?

[Old Fart Trying]

I have noticed a huge jump in download usage. At times i look at my ISP's daily download graph and noticed that big usage is occuring at times when my family is on.

I have a D-Link 300 router with 2 lan and 3 wireless comps feeding off it. I have Mac Address Filtering enabled and have just enabled Wep Wireless Securit - basic (128bit), as well as hidden the wireless system to the outside.

I have a log here of what looks like access to my system, but it/they show nowhere in my active session reports.

If anyone can suggest a way of excluding this intruder (if it is one) i would be eternally grateful!

Atm i am using my monthly adsl 12gig d/l usage in the first 8-10 days, then i am slowed to 56k for the rest of the months... a lil' annoying!

Thamks in advance

Old Fart.

____________________________________________________________

LOG:

Oct 24 10:00:46 chillirun: web ping successful
Oct 24 09:58:32 chillirun: config download and radius checks complete, chilli is online
Oct 24 09:58:32 chillirun: radius checks disabled in chillirun.conf
Oct 24 09:58:32 chillirun: uamserver = https://secure.tomizone.com/portal/chilli
Oct 24 09:58:32 chillirun: chillispot config file updated
Oct 24 09:58:21 chillirun: attempting to update chillispot config file
Oct 24 09:58:21 chillirun: retrieved chillirun config file
Oct 24 09:58:09 Remote management is disabled.
Oct 24 09:58:09 Block WAN PING is disabled.
Oct 24 09:57:55 Remote management is disabled
Oct 24 09:57:55 Block WAN PING is disabled.
Oct 24 09:57:55 Time synchronized at 2008/10/24, 09:57:55.
Jan 1 00:00:49 Remote management is disabled.
Jan 1 00:00:49 Block WAN PING is disabled.
Jan 1 00:00:49 DMZ disabled.
Jan 1 00:00:48 DHCP: Client receive ACK from 10.0.0.138, IP=10.0.0.1, Lease time=604800.
Jan 1 00:00:46 DHCP: Client send REQUEST to server 10.0.0.138, request IP=10.0.0.1.
Jan 1 00:00:46 DHCP: Client receive OFFER from 10.0.0.138.
Jan 1 00:00:46 DHCP: Client send DISCOVER.
Jan 1 00:00:38 DHCP: Client send DISCOVER.
Jan 1 00:00:34 DHCP: Client send DISCOVER.
Jan 1 00:00:34 chillirun: starting chillispot...
Jan 1 00:00:33 chillirun: starting up
Jan 1 00:00:32 DHCP: Client send DISCOVER.
Jan 1 00:00:25 DHCP: Server sending ACK to 192.168.0.100. (Lease time = 604800)
Jan 1 00:00:25 DHCP: Server receive REQUEST from 00:1a:4d:4f:2c:ac.
Jan 1 00:00:24 VPN (L2TP) Pass-Through enabled.
Jan 1 00:00:24 VPN (IPSec) Pass-Through enabled.
Jan 1 00:00:24 VPN (PPTP) Pass-Through enabled.
Jan 1 00:00:24 Domain blocking disabled.
Jan 1 00:00:24 URL blocking disabled.
Jan 1 00:00:24 MAC filter enabled (Deny).


BTW.. i dont have Tomizone activated.

[johnwill]

I suggest you upgrade to WPA security with a strong key. That will stop any intruder in their tracks. A 20 character random key will do the trick. :) WEP is anemic protection.

[Old Fart Trying]

Cheers Johnwill,

I will try that. So that "Chillirun" is an outsider bypassing my security then?

[johnwill]

I truthfully have no idea who Chillirun is, but it looks odd. I just make sure my network is secure and I don't have to deal with this kind of issue.

[Old Fart Trying]

THANK YOU!

Your advice seems to have worked... No MoreCHILLIRUN!

Btw... do you know of a network internet traffic monitor that can track usage through my wireless router to the individual users in my family?

If it also had a function were I could allocate a quota to each of my kids and once that is reached, restrictions could be imposed.

I have searched on the net and all of them seem too advanced for me, they are more geared to business use.

If you could name a couple i could look into i would be very grateful.

Ol' Fart.

[johnwill]

I don't think you'll find such a traffic monitor. The way standard SOHO routers work precludes such monitoring, you'd have to have a much more advanced router/firewall to have such capabilities.

[Old Fart Trying]

K.. thanx anyway :)