VERSION 1.0.1 UPDATED Saturday, March 3, 2001 By XaM of the wi2600.org crew. y0. Check wi2600.org/mediawhore/nf0/wireless regularly *********./legal disclaimer The information contained within is, of course, for informational and diagnostic purposes only. Any use of this information to intentionaly or unintentionaly cause harm, casualty, loss of propery, life, or other forms of disstress is not endorsed. If in your locale, possesing information of this nature is illegal, then it is your responsibility to discard and/or obey such regulations. The maintainer specificaly does not claim any liability or responsibility to ensure the legal use of the information contained herein. *********/end legal disclaimer ********* Products that don't have a known SSID at power-on or which simply do not have any features setup for the user by default are listed here: Cabletron RoamAbout 2.4 GHz DS products (newer 11mbit) BayStack 660 and 650 DS and FH 2.4 GHz products (older 2 mbit prpducts) Buffalo/Techworks Airstation 2.4 GHz DS (very new, Harris/Intersil Prism based) Lucent WaveLan (AP-1000, AP-500) DS 2.4 GHz products (access points utilize standard Orinoco PCMCIA cards) ********* and probably many others... -------------------------------------------------------------------------------- Default SSID's for several common 802.11 Access Point and PCMCIA card Products -------------------------------------------------------------------------------- Aironet 900Mhz/2.4GHz BR1000/e, BR5200/e and BR4800 Allso known as Aironet 630/640 (for 900 MHz) and Aironet 340 for 2.4 GHz DSSS Default SSID: 2 (default for all 900 MHz gear, often reused) Default SSID: tsunami (seems to show up randomly) Console Port: No Default Password Telnet password: No Default Password HTTP management: On by default, No Default Password NOTES: There is no IP address given to the bridge(s) by default, the user will need to have enabled/setup one. Howver, once you have the MAC of the bridge, rarp'ing the IP address out of it is trival, if it's been assigned one. Allso, if the bridge can be forceably restarted, default settings will allow the bridge to recieve an IP address via BOOTP and/or DCHP. Introducing a rouge server way allow the device to gain a more or less known IP in the case of rarp not working. -------------------------------------------------------------------------------- 3com AirConnect 2.4 Ghz DS (newer 11mbit, Harris/Intersil Prism based) Default SSID: comcomcom Notes: No known (yet) telnet/http/tftp/etc management passwords, or states of IP configuration. -------------------------------------------------------------------------------- Intel Pro/Wireless 2011 802.11 DSSS PC CARD: (seen using WLAN Monitor) Default SSID: 101 Default Channel: 3 (seen using WLAN Info program) Default SSID: xlan Default Channel: 3 (seen using Wireless LAN Profile Manager) Default SSID: intel Access POINT/REPEATER/BRIDGE: Default SSID: 101, 195 Default AP IP's seen: 157.235.92.238 157.235.92.200 157.235.92.169 157.235.92.104 157.235.92.23 NOTED MAC ADDRESSES: 00:A0:F8:00:C2:34 ..:..:..:..:..:74 ..:..:..:..:..:A0 It seems likely that 00:A0:F8:00:C2 will be a common prefix for some bridges. NOTES: Documentation seems to indicate that they are SNMP, HTTP, and TELNET manageable. No defualt passwords are known; there probably are none. -------------------------------------------------------------------------------- SMC 802.11 Access Points Default SSID: WLAN Default HTTP: user: default pass: WLAN_AP Console Port: No Password, AT command set NOTES: There is no IP address associated with this access point. It's management software presents html to the user, but seems to be using some variation on simple mac-only data transmission. This radio is OEM'ed from a third-party (http://www.eumitcom.com/) and as such has features similar to other devices in common use. Teletronics bridges are allso eumitcom OEM products (http://www.teletronics.com). It goes without saying that exploitation of one particular brand will probably be applicable to ALL products OEM'd from the same vendor. -------------------------------------------------------------------------------- ZCOMAX 1/2 Mbit DS 802.11 Station Bridges/Repeaters/Access point, modle XWL450 Default SSID: any, mello, or Test (all three are mentioned, "any" seems to be a common default) Default password: 1234 Console port: No Password, AT command set NOTES: User must use the ZCOMAX Wireless Lan "software" utility (more raw, non IP ethernet configuration). No IP address is known to exist on the bridge. ZCOMAX is the new product name for MAXTECH's wireless products. (as of sometime in mid 2000) -------------------------------------------------------------------------------- TELETRONICS WL-Access Points (1/2 Mbit, and 11 Mbit) Default SSID: any Default Password: 1234 Console port: No password, AT command set NOTES: Funny how this bridge/access point has the same defaults as the ZCOMAX bridge. It's rather apparent that they both utilized the same OEM product from Eumitcom. Configuration Utility is required to modify settings if not using local serial port. -------------------------------------------------------------------------------- ZYXEL Prestige 316 Gateway/Natbox/WirelessBridge (DS 802.11 capable) Default SSID: Wireless Default Channel: 1 (2412 MHz) Default console & telnet password: 1234 Console Port: Same password for system, ansi/vt100 terminal -------------------------------------------------------------------------------- LINKSYS WAP-11 802.11 DS AP, reportedly supports repeater mode Default SSID: linksys Default Channel: 6 Default SNMP Write: No Authentication NOTES: This bridge appears to have a default IP address upon first power on. It appears to get the default of 192.168.1.250 and is configured via two methods: local USB-connected software (from linksys), or via an SNMP-based (again, custom linksys software) program. There appears to be no amount of authentication in front of the bridges configuration, even after initial configuration. Have fun ;) Intersil-based Chiset. Appears to support diversity antenna systems, features reverse-polarity TNC (RPTNC) RF connectors. Most likely not Eumitcom-derived. -------------------------------------------------------------------------------- LINKSYS WPC-11 PCMCIA 802.11b DS 2.4 GHz cards Default Channel: 3 (win9x driver default) Default SSID: Wireless or linksys (win9x driver default) Default Channel: 11 or 6 (winNt4/2k driver default) Default SSID: Wireless or linksys (winNt4/2k driver default) NOTES: Card Defaults to "AdHoc" mode, not BSS or 802.11b AdHoc. Current data has been tested and verified in win98se, nt4, and w2k. -------------------------------------------------------------------------------- NETGEAR 802.11 DS Access Point More Information will be here once vailable Probably has common SSID to all products -------------------------------------------------------------------------------- MAXGATE Ugate 3200, 802.11 DS Access Point Suspected re-use of Eumitcom OEM radio, integrated antenna. No indication of diversity opperation. More info once available.