It’s not that it’s on the 172.16.0.0/12 range. That’s totally normal and used for all kinds of stuff.
It’s that it’s in 172.16.42.0/24 which is the default dhcp settings for a wifi pineapple. It’s the /24 mask given on the .42 that’s a little suspicious because that’s not a common range for anything else.
Being assigned one of those specific 253 hosts with that subnet mask would definitely make me think twice.
It’s the /24 mask given on the .42 that’s a little suspicious because that’s not a common range for anything else.
Well now I know. I operate a ton of /24 subnets in the 172.16.0.0/12 scope. Technically I could fit them in the 192.168.0.0/16 scope, but I have lots of students connecting SoHo wifi-routers to the subnets, and this way it’s pretty easy to tell, if someone put the WAN cable in a LAN port when people are getting 192.168.1.0/24 DHCP offers.
but I have lots of students connecting SoHo wifi-routers to the subnets, and this way it’s pretty easy to tell, if someone put the WAN cable in a LAN port when people are getting 192.168.1.0/24 DHCP offers.
I use 172.31.254.0/23 on my WiFi router. I guess I’d confuse you. /23 to just separate it nicely into 2 /24 blocks.
172.31.254.0/24 range is for manual assignments and 172.31.255.0/24 range is given out by DHCP.
I do not need that many IPs, it’s just for convenience.
I chose this range because of my school as it uses 192.168.0.0/16 range.
To help mitigate my possible mistakes when connecting to school network, I set the DHCP lease time to just 5 minutes.
172.31.254.0/24 range is for manual assignments and 172.31.255.0/24 range is given out by DHCP.
I do not need that many IPs, it’s just for convenience.
I do similar for my home network, mostly for a combination of future proofing and ease of use.
Realistically it would probably make more sense to segment it with more networks, but I’m only going to go so far with complexity for my home production
There’s nothing at all suspicious about the 172.16.0.0/12 address block. It’s a standard block of IP addresses that’s reserved for use on local networks, just like 10.0.0.0/8 and 192.168.0.0/16. It’s not a scheme exclusively or primarily used for illicit purposes.
There’s nothing at all suspicious about the 172.16.0.0/12 address block.
Correct. However the 172.16.42.0/24 block is the default for a WiFi Pineapple. Any other range is usually ok, but the 42 on a /24 specifically would make me (and most people who actually know what a WiFi Pineapple is) avoid that network.
Sure, it’s one of many, but how often do you see that specific (42) block used? I honestly don’t think I ever have, outside of a pentest lab. The 172.16.42.0/24 (not just any 172.16 like you’re saying) block is the default for a WiFi Pineapple. Any other range is usually ok, but the 42 on a /24 granting WAN access specifically would make me (and most people who actually know what a WiFi Pineapple is) avoid that network.
Saying 172.16.0.0/12 is usually for pentesting scummy thing is very misleading…Saying it’s dangerous is like saying every websites using .xyz domain is dangerous(which makes little more sense than this, btw)
You clearly don’t know what a WiFi Pineapple is, because we’re zeroing in on the 42 and you liken it to the entire 172.16 block. And linking every .xyz domain to a specific block (42) that is used by default for a pentest device is even more misleading.
deleted by creator
It’s not that it’s on the 172.16.0.0/12 range. That’s totally normal and used for all kinds of stuff.
It’s that it’s in 172.16.42.0/24 which is the default dhcp settings for a wifi pineapple. It’s the /24 mask given on the .42 that’s a little suspicious because that’s not a common range for anything else.
Being assigned one of those specific 253 hosts with that subnet mask would definitely make me think twice.
Well now I know. I operate a ton of /24 subnets in the 172.16.0.0/12 scope. Technically I could fit them in the 192.168.0.0/16 scope, but I have lots of students connecting SoHo wifi-routers to the subnets, and this way it’s pretty easy to tell, if someone put the WAN cable in a LAN port when people are getting 192.168.1.0/24 DHCP offers.
I use 172.31.254.0/23 on my WiFi router. I guess I’d confuse you. /23 to just separate it nicely into 2 /24 blocks.
172.31.254.0/24 range is for manual assignments and 172.31.255.0/24 range is given out by DHCP.
I do not need that many IPs, it’s just for convenience.
I chose this range because of my school as it uses 192.168.0.0/16 range.
To help mitigate my possible mistakes when connecting to school network, I set the DHCP lease time to just 5 minutes.
I do similar for my home network, mostly for a combination of future proofing and ease of use.
Realistically it would probably make more sense to segment it with more networks, but I’m only going to go so far with complexity for my home production
could calyx vpn save you from a wifi pineapple?
Isnt it also for docker?
deleted by creator
Wtf is with the “…” Explain why pls.
There’s nothing at all suspicious about the 172.16.0.0/12 address block. It’s a standard block of IP addresses that’s reserved for use on local networks, just like 10.0.0.0/8 and 192.168.0.0/16. It’s not a scheme exclusively or primarily used for illicit purposes.
Correct. However the 172.16.42.0/24 block is the default for a WiFi Pineapple. Any other range is usually ok, but the 42 on a /24 specifically would make me (and most people who actually know what a WiFi Pineapple is) avoid that network.
deleted by creator
Sure, it’s one of many, but how often do you see that specific (42) block used? I honestly don’t think I ever have, outside of a pentest lab. The 172.16.42.0/24 (not just any 172.16 like you’re saying) block is the default for a WiFi Pineapple. Any other range is usually ok, but the 42 on a /24 granting WAN access specifically would make me (and most people who actually know what a WiFi Pineapple is) avoid that network.
You clearly don’t know what a WiFi Pineapple is, because we’re zeroing in on the 42 and you liken it to the entire 172.16 block. And linking every .xyz domain to a specific block (42) that is used by default for a pentest device is even more misleading.
deleted by creator
You mean op’s waifu was wrong?