1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
\r
2 "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
\r
3 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
\r
5 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
\r
6 <meta name="generator" content="AsciiDoc 8.2.2" />
\r
7 <style type="text/css">
\r
9 p, li, dt, dd, div, pre, h1, h2, h3, h4, h5, h6 {
\r
11 border: 1px solid red;
\r
16 margin: 1em 5% 1em 5%;
\r
21 text-decoration: underline;
\r
39 h1, h2, h3, h4, h5, h6 {
\r
41 font-family: sans-serif;
\r
43 margin-bottom: 0.5em;
\r
48 border-bottom: 2px solid silver;
\r
51 border-bottom: 2px solid silver;
\r
61 border: 1px solid silver;
\r
66 margin-bottom: 0.5em;
\r
76 font-family: sans-serif;
\r
83 font-family: sans-serif;
\r
87 font-family: sans-serif;
\r
89 border-top: 2px solid silver;
\r
95 padding-bottom: 0.5em;
\r
99 padding-bottom: 0.5em;
\r
103 div.tableblock, div.imageblock, div.exampleblock, div.verseblock,
\r
104 div.quoteblock, div.literalblock, div.listingblock, div.sidebarblock,
\r
105 div.admonitionblock {
\r
108 margin-bottom: 1.5em;
\r
110 div.admonitionblock {
\r
112 margin-bottom: 2.5em;
\r
115 div.content { /* Block element content. */
\r
119 /* Block element titles. */
\r
120 div.title, caption.title {
\r
121 font-family: sans-serif;
\r
125 margin-bottom: 0.5em;
\r
131 td div.title:first-child {
\r
134 div.content div.title:first-child {
\r
137 div.content + div.title {
\r
141 div.sidebarblock > div.content {
\r
142 background: #ffffee;
\r
143 border: 1px solid silver;
\r
150 div.listingblock > div.content {
\r
151 border: 1px solid silver;
\r
152 background: #f4f4f4;
\r
156 div.quoteblock > div.content {
\r
157 padding-left: 2.0em;
\r
163 div.verseblock + div.attribution {
\r
167 div.admonitionblock .icon {
\r
168 vertical-align: top;
\r
171 text-decoration: underline;
\r
173 padding-right: 0.5em;
\r
175 div.admonitionblock td.content {
\r
176 padding-left: 0.5em;
\r
177 border-left: 2px solid silver;
\r
180 div.exampleblock > div.content {
\r
181 border-left: 2px solid silver;
\r
185 div.verseblock div.content {
\r
189 div.imageblock div.content { padding-left: 0; }
\r
190 div.imageblock img { border: 1px solid silver; }
\r
191 span.image img { border-style: none; }
\r
195 margin-bottom: 0.8em;
\r
200 font-style: italic;
\r
202 dd > *:first-child {
\r
207 list-style-position: outside;
\r
210 list-style-type: lower-alpha;
\r
213 div.tableblock > table {
\r
214 border: 3px solid #527bbd;
\r
217 font-family: sans-serif;
\r
226 margin-bottom: 0.8em;
\r
229 padding-bottom: 5px;
\r
232 vertical-align: top;
\r
233 font-style: italic;
\r
234 padding-right: 0.8em;
\r
237 vertical-align: top;
\r
241 div#footer-badges { display: none; }
\r
246 font-family: sans-serif;
\r
250 margin-bottom: 0.1em;
\r
253 div.toclevel1, div.toclevel2, div.toclevel3, div.toclevel4 {
\r
269 /* Workarounds for IE6's broken and incomplete CSS2. */
\r
271 div.sidebar-content {
\r
272 background: #ffffee;
\r
273 border: 1px solid silver;
\r
276 div.sidebar-title, div.image-title {
\r
277 font-family: sans-serif;
\r
280 margin-bottom: 0.5em;
\r
283 div.listingblock div.content {
\r
284 border: 1px solid silver;
\r
285 background: #f4f4f4;
\r
289 div.quoteblock-content {
\r
290 padding-left: 2.0em;
\r
293 div.exampleblock-content {
\r
294 border-left: 2px solid silver;
\r
295 padding-left: 0.5em;
\r
298 /* IE6 sets dynamically generated links as visited. */
\r
299 div#toc a:visited { color: blue; }
\r
306 <p>VERSION: 1.0.5</p>
\r
307 <p>Updated: Tuesday, May 29, 2001 by Xam of wi2600.org cru. yo.</p>
\r
308 <p>Check wi2600.org/mediawhore/nf0/wireless regularly</p>
\r
309 <p><strong><strong></strong></strong><strong><strong>./legal disclaimer
\r
310 The information contained within is, of course, for informational
\r
311 and diagnostic purposes only. Any use of this information to
\r
312 intentionaly or unintentionaly cause harm, casualty, loss of propery,
\r
313 life, or other forms of disstress is not endorsed. If in your locale,
\r
314 possesing information of this nature is illegal, then it is your
\r
315 responsibility to obey such regulations.
\r
316 </strong></strong><strong><strong></strong></strong>/end legal disclaimer</p>
\r
317 <div class="listingblock">
\r
318 <div class="content">
\r
323 -Cabletron RoamAbout 2.4 GHz DS products (newer 11mbit)
\r
324 -Buffalo/Techworks Airstation 2.4 GHz DS (very new, Harris/Intersil Prism based)
\r
325 -Maxgate UGATE 802.11 bridge/natbox
\r
326 -newer "Orinoco" home access points
\r
327 -Teklogix - so far, they appear to do factory floor automation; with 802.11 ;)
\r
328 -Intel "anypoint" (proprietary HOME-RF crap..but worth keeping tabs on)
\r
330 I'm still working on investigating these...
\r
334 <p>Section 1: The Info, somewhat alphabeticaly</p>
\r
335 <p>Section 2: Will eventualy contain discussion of various things…</p>
\r
336 <p>Section 3: Thanks and Credits</p>
\r
337 <p>$$<strong>NEW SECTION!</strong>$$</p>
\r
338 <p>Section 4: Updatez & News</p>
\r
339 <div class="listingblock">
\r
340 <div class="content">
\r
345 <p>Default SSID's for several common 802.11 Access Point and PCMCIA card Products</p>
\r
346 <div class="listingblock">
\r
347 <div class="content">
\r
349 3com AirConnect 2.4 Ghz DS (newer 11mbit, Harris/Intersil Prism based)
\r
351 Default SSID: comcomcom
\r
353 Notes: No known (yet) telnet/http/tftp/etc management passwords, or states of IP
\r
357 <p>Aironet 900Mhz/2.4GHz BR1000/e, BR5200/e and BR4800
\r
358 Allso known as Aironet 630/640 (for 900 MHz) and Aironet 340 for 2.4 GHz DSSS</p>
\r
359 <p>Default SSID: 2 (default for all 900 MHz gear, often reused)
\r
360 Default SSID: tsunami (seems to show up randomly)</p>
\r
361 <p>Console Port: No Default Password
\r
362 Telnet password: No Default Password
\r
363 HTTP management: On by default, No Default Password</p>
\r
364 <p>NOTES: There is no IP address given to the bridge(s) by default, the user will
\r
365 need to have enabled/setup one. Howver, once you have the MAC of the bridge,
\r
366 rarp'ing the IP address out of it is trival, if it's been assigned one. Allso,
\r
367 if the bridge can be forceably restarted, default settings will allow the bridge
\r
368 to recieve an IP address via BOOTP and/or DCHP. Introducing a rouge server way
\r
369 allow the device to gain a more or less known IP in the case of rarp not
\r
371 <div class="listingblock">
\r
372 <div class="content">
\r
374 BayStack 650/660 802.11 DS AP
\r
376 Default SSID: "Default SSID"
\r
377 Default admin pass: <none>
\r
379 MAC addr: 00:20:d8:XX:XX:XX
\r
381 NOTES: default to the 10 net address, 2 mbit products.
\r
384 <p>Compaq WL-100 (reportedly allso the WL-200/300/400 devices as well)</p>
\r
385 <p>Default SSID: Compaq</p>
\r
386 <p>More info once available.</p>
\r
387 <div class="listingblock">
\r
388 <div class="content">
\r
390 Dlink DL-713 802.11 DS AP
\r
393 Default Channel: 11
\r
394 Default IP address: DHCP-administered
\r
396 Reliable info is scarce, hopefully soon we'll have more ;)
\r
399 <p>INETL Pro/Wireless 2011 802.11 DSSS Product Families:</p>
\r
401 <p>(seen using WLAN Monitor)</p>
\r
402 <p>Default SSID: 101
\r
403 Default Channel: 3</p>
\r
404 <p>(seen using WLAN Info program)</p>
\r
405 <p>Default SSID: xlan
\r
406 Default Channel: 3</p>
\r
407 <p>(seen using Wireless LAN Profile Manager)</p>
\r
408 <p>Default SSID: intel</p>
\r
409 <p>Access POINT/REPEATER/BRIDGE:</p>
\r
410 <p>Default SSID: 101, 195</p>
\r
411 <p>Default AP IP's seen:</p>
\r
417 <p>NOTED MAC ADDRESSES:</p>
\r
418 <p>00:A0:F8:00:C2:34
\r
420 ..:..:..:..:..:A0</p>
\r
421 <p>It seems likely that 00:A0:F8:xx:xx:xx will be a common prefix for some
\r
423 <p>NOTES: Documentation seems to indicate that they are SNMP, HTTP, and TELNET
\r
424 manageable. No defualt passwords are known; there probably are none.</p>
\r
425 <div class="listingblock">
\r
426 <div class="content">
\r
428 LINKSYS Product Families:
\r
431 LINKSYS WAP-11 802.11 DS AP, reportedly supports repeater mode
\r
433 Default SSID: linksys
\r
435 Default WEP key one: 10 11 12 13 14 15
\r
436 Default WEP key two: 20 21 22 23 24 25
\r
437 Default WEP key three: 30 31 32 33 34 35
\r
438 Default WEP key four: 40 41 42 43 44 45
\r
440 Extended WEP key pattern: 10 11 12 13 14 15 16 17 18 1a 1b 1c ...
\r
441 20 21 22 23 24 25 26 27 28 2a 2b 2c ...
\r
442 30 31 32 ... untill the input fields are full
\r
444 Default SNMP Write: No Authentication
\r
446 NOTES: This bridge appears to have a default IP address upon first power on. It
\r
447 appears to get the default of 192.168.1.250 and is configured via two methods:
\r
448 local USB-connected software (from linksys), or via an SNMP-based (again, custom
\r
449 linksys software) program. There appears to be no amount of authentication in
\r
450 front of the bridges configuration, even after initial configuration. Fun!
\r
451 Intersil-based Chiset. Appears to support diversity antenna systems, features
\r
452 reverse-polarity TNC (RPTNC) RF connectors. Most likely not Eumitcom-derived.
\r
456 LINKSYS WPC-11 PCMCIA 802.11b DS 2.4 GHz cards
\r
458 Default Channel: 3 (win9x driver default)
\r
459 Default SSID: Wireless or linksys (win9x driver default)
\r
461 Default Channel: 11 or 6 (winNt4/2k driver default)
\r
462 Default SSID: Wireless or linksys (winNt4/2k driver default)
\r
464 NOTES: Card Defaults to "AdHoc" mode, not BSS or 802.11b AdHoc. Current data
\r
465 has only been tested in win98, nt4, and w2k. See data on Linksys WAP11 for WEP
\r
469 <p>MAXGATE Ugate 3200, 802.11 DS Access Point</p>
\r
470 <p>Suspected re-use of Eumitcom OEM radio, integrated antenna. No indication of
\r
471 diversity opperation.
\r
472 More info once available.</p>
\r
473 <div class="listingblock">
\r
474 <div class="content">
\r
476 Netgear 802.11 DS products, ME102 and MA401
\r
478 Default SSID: Wireless
\r
480 Default IP address: 192.168.0.5
\r
481 Default WEP: Disabled
\r
482 Default WEP KEY1: 11 11 11 11 11
\r
483 Default WEP KEY2: 20 21 22 23 24
\r
484 Default WEP KEY3: 30 31 32 33 34
\r
485 Default WEP KEY4: 40 41 42 43 44
\r
486 Default MAC: 00:30:ab:xx:xx:xx
\r
489 NOTES: Harris Intersill/Prism based radio, AP supports antenna diversity,
\r
490 client cards most likely do as well. SNMP over IP is typical management style.
\r
491 No apparent administrativie authentication. No apparent limit on Broadcast-
\r
492 Associations. Have Fun!
\r
495 <p>SMC Access Point Family</p>
\r
496 <p>SMC2652W: Single Dipole, non-diversity (OEM radio)</p>
\r
497 <p>Default SSID: WLAN
\r
498 Defualt Channel: 11
\r
499 Default HTTP: user: default pass: WLAN_AP
\r
500 Default MAC: 00:90:d1:00:b7:6b (00:90:d1:xx:xx:xx)
\r
501 Console Port: No Password, AT command set</p>
\r
502 <p>NOTES: There is no IP address associated with this access point, by default…
\r
503 Scanning for the AP with the "AP Utility" will reveal the radio, and then also
\r
504 set the Ip address to something in the network range of the PC running the
\r
506 <p>This radio is OEM'ed from a third-party
\r
507 (http://www.eumitcom.com/) and as such has features similar to other devices in
\r
508 common use. Teletronics bridges are allso eumitcom OEM products
\r
509 (http://www.teletronics.com). It goes without saying that exploitation of one
\r
510 particular brand will probably be applicable to ALL products OEM'd from the same
\r
512 <p>SMC2526W: Wireless Access Point Dual-Dipole, diversity, (non-oem)</p>
\r
513 <p>Default SSID: WLAN
\r
514 Defualt IP: 192.168.0.254
\r
515 Default MAC: 00:90:d1:00:11:11 (00:90:d1:xx:xx:xx)
\r
516 Default AP Name: MiniAP
\r
517 Default Channel: 11
\r
518 Default Admin Pass: MiniAP</p>
\r
519 <p>Notes: Can be DHCP client (!) if the user setup the bridge as such, can allso
\r
520 send packets to specified Default Gateway. Mmm, free smurf toy! Uses a
\r
521 SNMP-Ish, IP-transported management application.</p>
\r
522 <p>SMC2682W EZ-Connect Wireless Bridge, Single Dipole, non-diversity</p>
\r
523 <p>Default SSID: BRIDGE
\r
524 Defualt Channel: 11
\r
525 Default Admin pass: WLAN_BRIDGE
\r
526 Default MAC: 00:90:d1:00:b8:9c (00:90:d1:xx:xx:xx)</p>
\r
527 <p>Notes: This baby supports network-to-network bridging, not only Access Point
\r
528 functions. When you see it, it may be linking some rather important stuff.
\r
529 Apparently, the side of the bridge link opperating as the "master" can allso
\r
530 associate wireless client cards just like a normal AP. However, the "slave"
\r
531 side can't. Defaults to "Bridge Master" ;) Maybe buying one of these would be
\r
532 a "good thing [TM]" ? Bridge seems to be DHCP-aware, if configured to pull an
\r
533 address via this method.</p>
\r
534 <div class="listingblock">
\r
535 <div class="content">
\r
537 SOHOware NetBlaster II
\r
539 Default SSID: same as MAC address (example: 0080c6fac430)
\r
540 Default MAC: 00:80:c6:xx:xx:xx
\r
543 Notes: Way to go SOHOWARE! Yes! Use the MAC address as the defualt SSID! In
\r
544 fact, go one step further and print the MAC on the base of the AP itself!
\r
546 Anyway, when you see one of these, make sure you revisit the site. It has no
\r
547 hope of filtering broadcast associations, so you'll be able to scan for it with
\r
548 minimal effort. Gogogadget anonymous-internet-access!
\r
551 <p>Symbol AP41x1 and LA41x1 / LA41x3 802.11 DS Devices</p>
\r
552 <p>Default SSID: 101
\r
553 Default MAC: 00:a0:0f:xx:xx:xx
\r
554 Default WEP key one: 10 11 12 13 14 15
\r
555 Default WEP key two: 20 21 22 23 24 25
\r
556 Default WEP key three: 30 31 32 33 34 35
\r
557 Default WEP key four: 40 41 42 43 44 45</p>
\r
558 <p>Extended WEP key pattern: 10 11 12 13 14 15 16 17 18 1a 1b 1c …
\r
559 20 21 22 23 24 25 26 27 28 2a 2b 2c …
\r
560 30 31 32 … untill the input fields are full</p>
\r
561 <p>Default Admin Pass: unknown as of yet</p>
\r
562 <p>Notes: Features HTTP and TELNET management, probably has weak/lame default
\r
563 password (if any). No notes on defualt IP address, although RARP is said to be
\r
564 supported by the bridge (i.e. associate & yank the IP from the bridges MAC ;)</p>
\r
565 <div class="listingblock">
\r
566 <div class="content">
\r
569 TELETRONICS WL-Access Points (1/2 Mbit, and 11 Mbit)
\r
572 Default Password: 1234
\r
573 Console port: No password, AT command set
\r
575 NOTES: Funny how this bridge/access point has the same defaults as the ZCOMAX
\r
576 bridge. It's rather apparent that they both utilized the same OEM product from
\r
577 Eumitcom. Configuration Utility is required to modify settings if not using
\r
581 <p>Wave Lan Family:</p>
\r
582 <p>Default SSID: "WaveLAN Network"
\r
583 Default channel: 3</p>
\r
584 <p>NOTES: It seems that various incarnations of Wavelan-Based devices are cropping
\r
585 up all over. I've come accross several OEM's which use the Wavelan cards, and
\r
586 even go so far as to support COR/ROR modes of opperation (i.e. the proprietary
\r
587 metod point-to-multipoint and dedicated-links can optionaly opperate in when
\r
588 using Wavelan hardware).</p>
\r
589 <div class="listingblock">
\r
590 <div class="content">
\r
592 ZCOMAX 1/2 Mbit DS 802.11 Station Bridges/Repeaters/Access point, modle XWL450
\r
594 Default SSID: any, mello, or Test (all three are mentioned, "any"
\r
595 seems to be a common default)
\r
596 Default password: 1234
\r
597 Console port: No Password, AT command set
\r
599 NOTES: User must use the ZCOMAX Wireless Lan "software" utility (more raw, non
\r
600 IP ethernet configuration). No IP address is known to exist on the bridge.
\r
601 ZCOMAX is the new product name for MAXTECH's wireless products. (as of sometime
\r
605 <p>ZYXEL Prestige 316 Gateway/Natbox/WirelessBridge (DS 802.11 capable)</p>
\r
606 <p>Default SSID: Wireless
\r
607 Default Channel: 1 (2412 MHz)
\r
608 Default console pass: 1234
\r
609 Default telnet pass: 1234
\r
610 Console Port: Same password for system, ansi/vt100 terminal</p>
\r
611 <div class="listingblock">
\r
612 <div class="content">
\r
616 Articles from a few people are planned to be here by next revision.
\r
620 <p>well, wow.. here it is at the fourth revision, with more data. I feel like this
\r
621 is actualy going somewhere! Hope the <em>audience</em> is enjoying reading it!</p>
\r
622 <p>Thanks this time arround, again, to Foofus, Dover, and other #dc-stuff pals.</p>
\r
623 <div class="listingblock">
\r
624 <div class="content">
\r
628 Created in VI. What's EE? What's Pico? What's Emacs?
\r
631 version 1.0.5 - Added several new things, a few default wep keys, several extra
\r
632 details regarding setup/configurations for SMC AP's.. Corrected
\r
633 some linksys info.. Added new info for future bridges/ap's to be
\r
634 investigated. Oh yes, added Section 4 ;) SHIT'S FINALY IN ALPHA-
\r
637 version 1.0.4 - Added new SMC gear, SOHOware, and additionial info for Symbol
\r
638 gear. Began research of TEKLOGIX gear, and more specificaly,
\r
639 why it seems to crop up all over the place... Added several
\r
640 *verified* vendor MAC addresses to a few bridges/AP's...
\r
642 version 1.0.3 - I forget everything that got changed from the first SSID info
\r
643 release. I think I just cleaned up some spelling errors. Yah ;)
\r
647 <div id="footer-text">
\r
648 Last updated 01-Nov-2009 04:31:38 CEST
\r