Wireless Device Detection Query

coolcool1227

I enable "Show Wi-Fi notifications" option as my Laptop is on network and but with the said option enable, Bitdefender pop-up twice or thrice showing some IP addresses are connected, and this continue with a span of about 10secs. A snapshot is attached for reference.

alexcrist

Hello ONT,

This is somewhat normal.

There are specific steps which a system has to take when it announces it's presence in the network (this is done so the other systems in the network are made aware of it's presence, so, for instance, the router/server knows that it's online, and has a particular IP and MAC address, so all packets coming from/going to that address should be sent to that destination).

If the system takes these steps twice, than BitDefender will announce it twice. Usually, when a system comes online, it only announces its presence once. But this might repeat, for instance, when the system refreshes it's IP address (manually, by the user, or automatically, from the router/server, in case the IP lease expires). So even if the system didn't actualy go offline, it might re-announce it's presence in the network, which will make BitDefender show that popup again.

Also, some systems might have multiple different IP addresses (for instance, I own a router which has the gateway address, and also a separate broadcast address, which makes BitDefender announce both IPs).

There's kinda nothing that can be done to filter these requests, because BitDefender doesn't keep track of online systems. It just monitors these announcements, and displays the adequate popup when needed. If those popups become stressful for you, you can simply disable them completely.

Personally, I only recommend keeping that option enabled when you are in your own wireless network (for instance, at home), and you have a limited number of systems connecting to the network. This way, the popup number will be very low, and also you will be able to actually monitor them and see if any strange system accessed your network.

On public (or private, but larger) wireless networks, this option is kinda useless, because it makes BD show a very high number of popups (each time a system connects and/or refreshes it's IP address) and you won't be able to actually see if a new IP connected to the network, so you won't be able to spot any intruders. If you have to manage a larger wireless network, I recommend monitoring the access to it from a router/server, because it can offer a wider range of tools for monitoring and/or restricting access to the network.

Cris.

coolcool1227

Hi Cris

@If the system takes these steps twice, than BitDefender will announce it twice.

Since the popup appears just for 3-4 secs, is this normal for that system to refreshes it's IP address so rapidly resulting in the appearance of popup of the same IP more than once? Are there chances of malware reside in that system?

alexcrist

Yes, it could be normal, depending on the actual system (and the network adapter driver).

For instance, assuming this scenario: you have a portable system and you move it to another wireless network. There, it will get the IP (just an example) 192.168.0.90.

When you come back to your home, let's assume that your router is set to provide addresses in the rage 192.168.30.*. When you turn your laptop on and it connects to the network, it will first announce its presence as 192.168.0.90, which will make BD display a popup with this IP. At that exact point, the router will react and announce the system that ”your IP is not valid in this network”. And a new IP is allocated to the system, for instance 192.168.30.50 (and IP in the range set in the router). And the system will then announce, again, its presence in the network with the new IP, which will make BitDefender show a new popup, basically in the same time with the previous (because these changes are made very fast).

Now, in your case, the IP in all popups is the same. However, if they are allocated automatically by the gateway, the IP has a limited lease. And so, assuming this:

- the system has the IP 192.168.30.50, and the lease expires on 09/30/2010, at 2PM.

- when you turn on the system at 3PM, it will announce its presence with that IP, but with an expired lease. And, again, the router should react and refresh it's IP and lease. And even if the system gets the same IP (with a new lease), it will announce its presence again. Therefore, at least 2 announcements are made in a few seconds, so BD will show 2 popups.

Now... what I said above is just an assumption. It is a probable scenario, but it doesn't mean that it's the same in your case. The circumstances in which a system refreshes its IP (and makes a new announcement) are multiple. However, it's unlikely that a malware resides in that system. There are some known malware which change the gateway and proxy settings in the system, but you can check for this kind of changes very easily. On the ”affected” computer, open cmd and run the command:

ipconfig /all

If all settings shown as a result are correct, then it means that the network driver from that system just makes multiple announcements (for whatever reasons).

Cris.

coolcool1227

Actually only one router is used in the network, but the popups appear twice only for the IP:192.168.1.59. However I can check when this PC will be freed.

Many thanks for your prompt response.

coolcool1227

An interesting thing found, I can't browse that PC,but Bitdefender popup shows its detection continuously, Why?

PC name : Arif

IP Address: 192.168.1.59

alexcrist

File and Printer sharing service (on Windows XP) has absolutely nothing to do with the system announcing its presence on the network. The sharing service can be restricted or disabled all together, or it can be blocked from within the firewall (BitDefender Firewall automatically blocks sharing for untrusted networks).

On the other hand, a system HAS to announce its presence in ANY network, because otherwise the gateway (and other systems) can't communicate with that system. In other words, if the system doesn't announce its presence (broadcasting its IP and MAC addresses), it basically cannot connect to the network and won't be able to receive or transmit any information.

So the fact that you cannot remotely browse that system has nothing to do with BitDefender showing popups about that system connecting to the network. If you want to browse that system's shared files, but can't do so, please check that:

- file and printer sharing is active on both systems (for any user)

- that system actually HAS shared files (in Windows XP, sharing is not possible except when you actually share files)

- no firewall is blocking traffic to/from that system

Cris.

coolcool1227

Hi Cris

With Stealth Mode ON on one PC, can other PC with Bitdefender installed and “Show Wi-fi notification” option enable detect the first stealth enabled PC?

coolcool1227

Any reply?

coolcool1227

Any reply...

coolcool1227

With Stealth Mode ON on one PC, can other PC with Bitdefender installed and “Show Wi-fi notification” option enable detect the first stealth enabled PC?

Or rephrasing above that

Does Stealth Mode (ON) affect the "Show Wi-Fi Notifications"?

rootkit

Hi ONT

No, it doesn't.

With Stealth Mode ON, your computer is invisible from both the local network and the Internet.

It has nothing to do with Show Wi-Fi Notifications.

Take care.

coolcool1227

Hi ONT

No, it doesn't.

With Stealth Mode ON, your computer is invisible from both the local network and the Internet.

It has nothing to do with Show Wi-Fi Notifications.

Take care.

It means that with Stealth Mode ON, my IP address will not be shown in Firewall ---> Advanced ---> Adapter Rules ---> Local Area Connection Zone whatever Show Wi-Fi Notifications option is ON or OFF?

coolcool1227

It means that with Stealth Mode ON, my IP address will not be shown in Firewall ---> Advanced ---> Adapter Rules ---> Local Area Connection Zone whatever Show Wi-Fi Notifications option is ON or OFF?

It means that with Stealth Mode ON on my PC, my IP address will not be shown in Firewall ---> Advanced ---> Adapter Rules ---> Local Area Connection Zone whatever Show Wi-Fi Notifications option is ON or OFF on another PC (whatever its Stealth Mode settings)?

coolcool1227

Any reply?

rootkit

Hi Omer

If Stealth Mode is ON, the IP address will not be visible in the network and your machine will be hidden for port scans.

Thank you.