malware - /hnap1/ scans router compromised or worm? - Information Security Stack Exchange 
5


1
Recently, I saw some strange entries on my local-only webserver. The thing is I don't know if the attack came from outside the network or from an infected machine. I have read up a little on the hnap attack, but I'm still unsure what to do about it. Essentially, Cisco routers have vulnerabilities because of the "home network administration protocol." And from what I've read there is no solution.

If it is an infected system I'd like to pinpoint it by listening to network traffic, but I'm not sure how to do that. I tried using snort and wireshark, but these programs seem pretty advanced. Alternatively, I am thinking that if someone was able to compromise my network by cracking the network key, they could join the network and run whatever scans they want. Otherwise, maybe someone is accessing from outside the local network.

Here are the entries (updated to show multiple requests from my PC):


security.stackexchange.com/questions/168744/hnap1-scans-router-c...

Kopyala