Recommended Posts

So lately we have been having an issue with people viewing adult content at work.

Basically someone comes in and forgets they are on the company wireless and goes to find a site o' fun on their mobile device.

Until recently, I've been able to track down who it was. But now default device naming conventions prevent that. Android_longassstring doesn't help me.

All I know is it is 192.168.100.18.

Two questions:

1. How can I block this IP from accessing the internet while it has a DHCP lease.

2. Any other ways of tracking down the idiot?

Thanks.

Link to comment
https://www.neowin.net/forum/topic/1103809-block-internal-ip/
Share on other sites

What do you have in place at work for your router/firewall? How are you seeing where the people are going? Many proxies have a way of filtering.

Give me some details of what your working with for infrastructure and or budget and we can work out the best way to filter using what you have or that will fit into your budget. I can not believe a place of business does not filter internet traffic? You can do some amazing things on really 0 budget, if you have some hardware to work with and some time for setup.

As to tracking down a wireless client - yeah that can be very difficult. You could implement login to access your wireless via your AD/LDAP, etc You could setup a captive portal sort of thing even if you just allow open wireless connectivity.

There are lots and lots of options here - just need to know what your working with, and what you might be able to add to your network.

Off the cuff, some random mobile device its going to be impossible to track - simple thing would be to block his mac from getting an IP of said device... Or just setup a reservation for his mac so that he gets same IP you block at your firewall from getting to the internet. If you know his IP, you know his mac - if you know his mac you can setup a reservation so he always gets the same IP, once you know that device will always get the same IP, you can block that IP from accessing the internet. Or depending on your setup block from even getting an IP, etc.

Love to help you fix up your network so you can filter and monitor users internet traffic - just need somewhere to start, ie what do you have to work with.

Pretty simple setup -

Server -> Sonicwall w/ 2 switches and an AP -> ISP -> OpenDNS

So if content manages to get by the Sonicwall, it happens - hits OpenDNS and gets stopped.

We have the filtering in place, that's not the issue. It's finding out who attempted to access these sites.

So I know the IP because of DHCP, how can I pull the MAC ID and block that? Can I block it in DHCP?

Why allow phones to access the network anyway? Why. It throw in a content manager other than opendns. Something that can manage it better? Or have open dns integrate with ad so it requires ad auth. The auth, it creates a log of who and what the accessed. No need to hunt crap down, you know who did it based on user account.

"hits OpenDNS and gets stopped."

What?? Sorry opendns is provider of dns, it does not stop anything. You ask it for stuff like www.neowin.net or www.playboy.com, etc. and then it either returns the correct IP for you to go there, or it sends you its IP so you end up on some block page. It does not actually filter traffic, unless they have recently added proxy support?

So do you block 53 outbound to everything else other then the opendns servers? If not circumvention of your opendns filtering there any 6 year old could bypass ;) What sonicwall do you have? They provide web content filtering services - you just have to be licensed for them.

You could tie to opendns enterprise insight, sure this ties it to your AD -- I don't believe its very cost friendly?? And unless your blocking outbound udp/tcp 53 anyone can bypass it really easy.

What AP do you have? Does it tie in with your sonicwall? Model numbers of your devices would be very helpful so we know exactly what we are dealing with. But you have a sonicwall, which sc302 I believe has more exp with than me. But clearly they can block who you want, and if your AP is tied in with it you can require AD to auth to even get on your wireless.

What?? Sorry opendns is provider of dns, it does not stop anything.

OpenDNS has a content filter that sometimes does better than the Sonicwall. That's what I meant about content getting stopped.

We have a Sonicwall TZ210, Cisco Aironet 1040 AP.

OpenDNS is too pricey for my budget (non profit organization) even with their "discounts".

I would imagine that either the Sonicwall or the Cisco device could tie in to AD but I've never done that before.

@sc302 - wireless is a "perk" I guess. But it's also needed so people can do their jobs and I'm not sure how much work it is to lock it all down to only X devices.

The sonic wall appliance has a purchasable subscription package for content filtering that does a pretty good job and should be the same or better than opendns. With this, it should also tie into ad to be able to give you reports based on user. If you don't sign in with an ad account, you don't get access. Turn off anonymous access.

Well if you want to know who is going where, I would connect both of them to AD. I would require auth to get on your wireless. So its just completely open now, or you have just a PSK setup?

So do you control your AP from the sonicwall or is it standalone? You don't have a cisco wireless controller for 1 AP that is for sure. But the TZ210 can handle up to 16 sonicpoints, or AP ;)

So you do content filtering now on the sonicwall, but you don't set policy based upon AD users?

But still a bit hazy on even your original question - if your doing content filtering at the sonicwall, and you notice someone going to site X, just block site X at the sonicwall. You don't really have to know who is going there to prevent them from going. Content filtering at sonicwall clearly has ability to whitelist/blacklist urls, ie custom filtering of sites.

So do you control your AP on the sonicwall, or standalone? Either way can show you how to point to your AD. What AD do you have setup? NT, 2k, 2k3, 2k8? Or you just running LDAP on some linux box?

I would do AD auth requirements, RADIUS or is it called 802.x EAP?. I was working at the City Hall for a few weeks last year and they set it up to use 802.1x EAP - which then required me to also put in my username/password. That would definitely lead back to me if I was browsing anything wrong even on my mobile phone :)

regardless, it still goes through the sw does it not? if you set it up where users need to auth to access the web, regardless of whether or not they are on the domain, you would easily be able to determine who is going where.

for example, when I am on my ad computer I can go out to the web where I am allowed and if I am on my phone I need to auth with my ad creds to get out to the web where I am allowed. In either case, they know where I am going and how long I have been there, or if I access a questionable site.

regardless, it still goes through the sw does it not? if you set it up where users need to auth to access the web, regardless of whether or not they are on the domain, you would easily be able to determine who is going where.

for example, when I am on my ad computer I can go out to the web where I am allowed and if I am on my phone I need to auth with my ad creds to get out to the web where I am allowed. In either case, they know where I am going and how long I have been there, or if I access a questionable site.

Yeah the AP goes through the Sonicwall. I don't know where I should setup the auth tho, I'd imagine I'd do that at the AP. Would it be better on the Sonicwall? Never done either...would love it to associate with LDAP though.

I don't know how Things work were you live(laws and such), but you should be aware of something called privacy. In Norway we're pretty strict about privacy. You should NEVER log computer usage like web traffic that can identify the user(without approval from the employees). If you Discover that employees often tries to Access blocked content, the right thing to do would be to: 1. Block Access(ex. using Your SW's content filtering). And 2. Send an email to ALL employees reminding them of the company's IT-policy, including accessing non-workrelated websites(or whatever you policy is).

@Graimer, yeah there is a huge difference between US law and say Norway for privacy.

So after you send out 140th mass email saying stay off the porn what happens? Do you finally track down the user and say Quit it?? ;)

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Indeed. But note that this has Wifi7, HDMI 2.1, BlueTooth 5.4, and 5G Ethernet, so even in the additional features list this bundle blows the Steam Machine away. And, with the money saved, one could improve this dramatically.
    • One of the strangest galaxies in our Universe could help answer some long overdue questions by Sayan Sen Image by Pixabay via Pexels | Not representative An international team of astronomers led by the Department of Astronomy at Tsinghua University has discovered an unusually metal-poor galaxy that may contain signs of first-generation star formation. The galaxy, named Metal-Pristine Galaxy COSMOS Redshift 3 (MPG-CR3), or CR3, was identified using observations from the James Webb Space Telescope (JWST), the Very Large Telescope (VLT), and the Subaru Telescope. The findings, published in The Astrophysical Journal Letters, describe CR3 as the most metal-poor galaxy known from the period known as "cosmic noon," around 11.5 billion years ago. Cosmic noon refers to a period when the universe was producing stars at its highest rate and galaxies were growing rapidly. In astronomy, "metals" refers to all elements heavier than helium, including oxygen, carbon, and iron. Because CR3 contains so few of these heavier elements, researchers say it closely resembles what scientists expect the earliest galaxies in the universe may have looked like. The discovery is significant because it could offer clues about Population III (Pop III) stars, the first generation of stars thought to have formed after the Big Bang. These stars are believed to have formed from gas made almost entirely of hydrogen and helium, before heavier elements were created inside stars and spread across the universe through supernova explosions. Hence this is why CR3 has been referred to as a "living fossil." Scientists have long believed that Population III stars existed only in the very early universe. As more generations of stars formed and died, they enriched surrounding gas with heavier elements, making the conditions needed for metal-free star formation increasingly rare. Because of this, researchers expected the formation of such stars to have largely ended after the epoch of reionization, a period when radiation from the first stars and galaxies transformed the neutral hydrogen filling the universe and made it largely transparent to ultraviolet light. CR3 appears to challenge that idea. The galaxy was observed at a redshift of z = 3.193 ± 0.016. Redshift measures how much light from a distant object has been stretched as the universe expands and helps astronomers determine how far back in time they are looking. In this case, the redshift corresponds to roughly 11.5 billion years ago during cosmic noon. Although the universe was already several billion years old by that point, CR3 shows characteristics more commonly associated with much earlier galaxies. Observations revealed exceptionally strong emissions from hydrogen and helium, including Lyα, Hα, and He I λ10830. Lyα, or Lyman-alpha emission, is a specific wavelength of light produced by hydrogen and is widely used to study distant galaxies. Hα emission is another hydrogen signature commonly used to trace active star formation, while He I λ10830 is produced by helium and can indicate the presence of very hot, young stars. The measured equivalent widths of EW₀(Lyα) = 822 ± 101 Å and EW₀(Hα) = 2814 ± 327 Å are among the highest ever observed in star-forming galaxies. Equivalent width is a measure of the strength of an emission line relative to the surrounding light, and such large values are typically associated with intense and very recent star formation. At the same time, researchers found no statistically significant detections of metal emission lines, including [O III] λλ4959, 5007 and C IV λλ1548, 1550. Emission lines act as chemical fingerprints that reveal which elements are present in a galaxy. Oxygen and carbon lines are commonly seen in galaxies that have already undergone significant chemical enrichment. Their absence in CR3 suggests an unusually pristine environment. Using abundance calibration methods developed with JWST observations, the team placed a 2σ upper limit on the galaxy's gas-phase metallicity of 12+log(O/H)<6.52, corresponding to less than 0.7% of the Sun's metallicity (Z < 7 × 10⁻³ Z⊙). Gas-phase metallicity measures the abundance of heavy elements in a galaxy's gas. A 2σ upper limit indicates that the true value is very unlikely to be higher than the quoted threshold. Even when accounting for uncertainties in the calibration methods, the most conservative limit remains 12+log(O/H)<6.95, making CR3 the most metal-poor galaxy identified at cosmic noon. The galaxy also appears to contain very little dust. Researchers measured a Lyα/Hα flux ratio of 13.9 ± 2.5, a result that suggests negligible dust attenuation, meaning very little of the galaxy's light is being absorbed or scattered by cosmic dust. Because dust is usually produced by earlier generations of stars, this finding further supports the idea that CR3 has experienced very little chemical enrichment. Further analysis using spectral energy distribution modelling, a technique that compares observed light with theoretical models, suggests that CR3 contains an extremely young stellar population only around 2 million years old. The modelling, which used Population III stellar templates, also indicates the galaxy has a stellar mass of approximately 6.1 × 10⁵ M⊙. The symbol M⊙ represents one solar mass, or the mass of the Sun. One of the key questions raised by the discovery is how such a chemically primitive galaxy could exist in a universe that had already spent billions of years producing heavier elements. To investigate this, the researchers examined CR3's surroundings. Their analysis suggests the galaxy may lie in a slightly underdense environment, with a density contrast of roughly δ ≈ −0.12. An underdense region contains less matter and fewer galaxies than average. The team suggests that this relative isolation may have helped preserve pockets of pristine gas. Metal-rich material expelled from nearby galaxies may never have reached CR3, while the lower rate of galaxy mergers and interactions could have slowed the mixing of enriched gas into the system. If future observations confirm these findings, CR3 could provide some of the strongest evidence yet that first-generation star formation continued well after the epoch of reionization. Such a result would challenge the conventional view that pristine star formation ended by z ≳ 6 and suggest that small pockets of metal-free gas survived much longer than previously thought. Researchers stress that more observations will be needed to determine the galaxy's true nature. Future spectroscopic studies with higher resolution and better signal quality could help confirm whether CR3 is genuinely hosting Population III star formation. The discovery is also expected to encourage searches for other similar galaxies, which could help astronomers better understand how the first stars formed and how galaxies evolved in the early universe. Source: Tsinghua University, IOPscience This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • "I think in the immediate absence of a partner to apply relief" In the words of Sterling Archer... "Phrasing!"
    • For me, the fundamental problems with these "smartglasses" is that they really don't work well for people with significant prescriptions and massively up the price if you use attached lenses if they have displays, and if they don't, then they're not actually "smart" anything, rather just connecting to your phone and relaying voice to an AI. In a few cases like this, they throw in small cameras to feed video to the AI. All around, these feel like both a solution looking for a problem, and the problems it tries to solve seem more easily solved by different approaches and designs. Oddly, if the rumours are true, Apple may actually have invented something for once and it kind of does this right: put cameras in ear buds and manage the interface to AI exactly as most of us do: tapping on an ear bud and saying "Hey Google" or "Hey Siri." That makes them compatible with almost everyone, can double up as a hearing assist device, an impaired vision assist device, a "smart" device... and answer your phone and play music. That just seems like a better solution all around.
  • Recent Achievements

    • Dedicated
      HidekoYamamoto94 earned a badge
      Dedicated
    • One Month Later
      timbobit earned a badge
      One Month Later
    • One Month Later
      nates earned a badge
      One Month Later
    • Week One Done
      Almohandis earned a badge
      Week One Done
    • Rookie
      dorf went up a rank
      Rookie
  • Popular Contributors

    1. 1
      +primortal
      454
    2. 2
      +Edouard
      161
    3. 3
      PsYcHoKiLLa
      107
    4. 4
      Michael Scrip
      84
    5. 5
      Steven P.
      71
  • Tell a friend

    Love Neowin? Tell a friend!