Weird network setup - trying to understand how it works

[Martin Jones]

Alright, so a friend of mine wanted to download a game, just to realize, that a 4GB game takes nearly 5 hours to download! 

 

She has an older brother, so I asked him what going on, because 5Mbit speed is just... Not a Norm in 2020. We both have the same ISP.

 

I took a look at the router, it was some TP Link cheapo router, but there were couple of odd things. Firstly, the router wasn't connected to a WAN port! It had a single cable coming from the roof (wireless AP to connect to the ISP) to a LAN port? What the hell? I tried to plug the cable into the WAN port, but that made the internet not work, wifi was still broadcasting though, so that confirmed the router I had in hands was the one broadcasting the signal. When connecting to other LAN ports, it still worked.

 

Another thing I tried was connecting to the router admin web panel. To my surprise, when I checked for default gateway and tried to connect to it using my browser, I got "refused to connect" message. That meant one of 2 things. The router had IP or MAC limitation on who can load the admin panel or it had the GUI disabled and was only accessible using telnet or something similar.

 

I used a phone app to scan for all devices connected to the network and it listed the router as a Mikrotik device, which made me believe that it was probably flashed with custom firmware. This all is really odd because her brother refused to elaborate and was acting dumb, but I think he set a limit for his family so he can use all the bandwidth for himself.

 

What is your take on this? Is there anything I could try or something I have missed? This setup is really odd, not only because the "internet" cable is not connected to the WAN port, but also because the router reports itself as a different brand than what it really is and also the inability to connect to the admin panel. 

[Hairless Monkey Boy]

5 minutes ago, Martin Jones said:

This all is really odd because her brother refused to elaborate and was acting dumb, but I think he set a limit for his family so he can use all the bandwidth for himself.

Seems like the obvious answer.

 

That router you found is not acting as a router on the network, it is acting as a wireless access point.

[flashiling]

if there's a phone cable in the wall connected to the router you don't need to have anything in the WAN port, as that little cable is the one sending and reciving the data via the ISP.

 

and not having a web GUI is normal on standard routers that your ISP provides because it's easy to mess up your internet if you "think" you know what you're doing, hence why it's mostly disabled by default.

 

mikrotik does allow people to download their RouterOS, so maybe the brother has been playing around with the network settings.

what speeds are they paying for normally.

[Martin Jones]

7 minutes ago, Not Wills said:

My brain has melted, this all sounds stupid.

Exactly! That's how I felt as well. It literally made my brain hurt. I felt really dumb for not being able to solve it. When anyone I knew had issues with their network or wanted to connect new APs to extend the range or whatever, I was always the one who got it done within an hour including the cable routing.

[Martin Jones]

4 minutes ago, flashiling said:

if there's a phone cable in the wall connected to the router you don't need to have anything in the WAN port, as that little cable is the one sending and reciving the data via the ISP.

 

and not having a web GUI is normal on standard routers that your ISP provides because it's easy to mess up your internet if you "think" you know what you're doing, hence why it's mostly disabled by default.

 

mikrotik does allow people to download their RouterOS, so maybe the brother has been playing around with the network settings.

what speeds are they paying for normally.

It's an old house, like really old. I doubt it even had a phone line in the first place. They got a dish on the roof, which connects to an AP over a few km distance. And that AP is connected to the LAN port on the router and a PoE adapter. That adapter just injects electricity into the Ethernet cable that goes on the roof - I've checked.

[flashiling]

Just now, Martin Jones said:

It's an old house, like really old. I doubt it even had a phone line in the first place. They got a dish on the roof, which connects to an AP over a few km distance. And that AP is connected to the LAN port on the router and a PoE adapter. That adapter just injects electricity into the Ethernet cable that goes on the roof - I've checked.

maye they placed the internet on the electric copper cables to run on, that works but could be why it runs slow.

and where are you from in the world? because mikrotik being based in latvia means that if you're from a different part of the world it's very plausible that the brother has been tampering with the router

[Stahlmann]

I don't think her brother is taking anything away for himself. 5Mbits is a very, very slow connection. I remind having trouble with our old 12Mbits connection as soon as both my brother and me played something at the same time. It just couldn't keep up. And when 1 of us watched 1080p content on youtube he besically blocked out the rest of the familiy from doing anything. Can't they get a better contract? Our upgrade from 12Mbits to 1Gbits was only ~30% more per month for 80x the bandwidth . With a new contract you normally get a new router aswell.

[Martin Jones]

9 minutes ago, HairlessMonkeyBoy said:

Seems like the obvious answer.

 

That router you found is not acting as a router on the network, it is acting as a wireless access point.

Wait, so... Let's try to figure this out.

 

You're saying that the router I had in hands was acting as a wireless AP, meaning there must have been another router that had a hidden SSID, which the router was connected to wirelessly. 

 

Then explain why there was a cable connected to the LAN port, which when disconnected, lost the internet connection? It it were a wired AP, then it would surely be connected to the WAN port, when in wireless mode, then anything connected to the LAN port would be a client device, though the only cable connected to the LAN port had PoE adapter connected to it and was going on the roof, probably to the satellite dish AP to connect to the ISP.

 

The wireless AP on the roof then would have to be connected to the another "hidden router" and not the one in the room. This all doesn't make sense.

[Martin Jones]

1 minute ago, Stahlmann98 said:

I don't think her brother is taking anything away for himself. 5Mbits is a very, very slow connection. I remind having trouble with our old 12Mbits connection as soon as both my brother and me played something at the same time. It just couldn't keep up. And when 1 of us watched 1080p content on youtube he besically blocked out the rest of the familiy from doing anything. Can't they get a better contract? Our upgrade from 12Mbits to 1Gbits was only ~30% more per month for 80x the bandwidth . With a new contract you normally get a new router aswell.

They have the same ISP and I get 50Mbit, this ISP doesn't really have speed tiers. Either you have internet or not. But depends on the time of the day. Sometimes it goes 20Mbit, sometimes 50.

 

If he didn't do anything with the network, why is the to link router acting like a Mikrotik device and the GUI is inaccessible?

[Hairless Monkey Boy]

1 minute ago, Martin Jones said:

You're saying that the router I had in hands was acting as a wireless AP, meaning there must have been another router that had a hidden SSID, which the router was connected to wirelessly.

Nope.

 

The "router" you found was not acting as a router but only a wireless access point to a wired network. It is a client on the wired network. It takes the wired network (plugged into LAN port) and creates a wireless SSID. The router handling DHCP is somewhere else on the network.

 

4 minutes ago, Martin Jones said:

though the only cable connected to the LAN port had PoE adapter connected to it and was going on the roof

Do you know this for sure?

[Martin Jones]

8 minutes ago, flashiling said:

maye they placed the internet on the electric copper cables to run on, that works but could be why it runs slow.

and where are you from in the world? because mikrotik being based in latvia means that if you're from a different part of the world it's very plausible that the brother has been tampering with the router

Nope. It's not on an electric copper for sure.

 

The router has 1 occupied LAN port, in which an PoE adapter is connected to, which then leads on the roof, where I presume is the long-distance-transmission AP. Weird thing is that the internet drops out (though wifi still visible) when disconnecting from the LAN port and doesn't work in the WAN port. Like why wouldn't it be connected to the WAN port?

 

I got similar setup home, because the same ISP, but mine goes: Router->WAN port->PoE adapter -> AP on the roof -> some ISP AP 5km away.

[Stahlmann]

2 minutes ago, Martin Jones said:

They have the same ISP and I get 50Mbit, this ISP doesn't really have speed tiers. Either you have internet or not. But depends on the time of the day. Sometimes it goes 20Mbit, sometimes 50.

Idk where you are from, apparently it's a whole lot different from the luxury here in germany...

5 minutes ago, Martin Jones said:

If he didn't do anything with the network, why is the to link router acting like a Mikrotik device and the GUI is inaccessible?

Well i don't have an answer to that. I also don't know her brother and if he would that evil. I can't imagine tampering with my family's router to have a better connection myself

[Martin Jones]

7 minutes ago, HairlessMonkeyBoy said:

Nope.

 

The "router" you found was not acting as a router but only a wireless access point to a wired network. It is a client on the wired network. It takes the wired network (plugged into LAN port) and creates a wireless SSID. The router handling DHCP is somewhere else on the network.

 

Do you know this for sure?

Yes, I know that for sure. Though I have no clue where the cable that carries the electricity from the PoE adapter goes. I can only presume on the roof but it's possible that it goes under the roof, where a secondary router could be, which then is connected to the AP on the roof. But why would it be already amplified with the PoE? Can it like daisy-chain the theoretical router under the roof and the AP on the roof to power both?

[Martin Jones]

10 minutes ago, Stahlmann98 said:

Idk where you are from, apparently it's a whole lot different from the luxury here in germany...

Well i don't have an answer to that. I also don't know her brother and if he would that evil. I can't imagine tampering with my family's router to have a better connection myself

We're neighbors. I'm from the Czech republic. Though if you're not living in a flat or in the center of the city, there's usually no way to get cable internet. 

We both live in a Village houses. I live in a 10 year old house (the Mayor is dumb and saved money by not planting an internet nor DLS cable - awesome stuff, gotta love politics) and she lives in like 100+ years old house. We both got no wired connectivity. And getting your cable to your house not only costs fortune, but you also gotta get like 50 signatures from neighbors that are also interested. This is a world wide issue. Get a big house with garden or live in a flat with 50 families and get fiber.

[Hairless Monkey Boy]

13 minutes ago, Martin Jones said:

Can it like daisy-chain the theoretical router under the roof and the AP on the roof to power both?

AFAIK yes.

[Martin Jones]

20 minutes ago, HairlessMonkeyBoy said:

AFAIK yes.

How do i connect to the "higher level" router if there's one? 192.168.2.1 (default gateway) doesn't show anything and when I used port sniffing tools to find all connected devices on the network, it only showed the default gateway (as Mikrotik device though it was a TP Link router) and then my phones and a friend's phone. Nothing else.

[Hairless Monkey Boy]

26 minutes ago, Martin Jones said:

192.168.2.1

Don't know, but the fact that this is the default gateway is fishy. Makes me think that the primary network is likely 192.168.1.1, and the shitty secondary that he setup for his family is on a different subnet. Slimey.

29 minutes ago, Martin Jones said:

it only showed the default gateway (as Mikrotik device though it was a TP Link router) and then my phones and a friend's phone. Nothing else.

You didn't see any of his devices on the network? Also fishy...

 

He obviously created a shitty subnet for his family to use.

[Hairless Monkey Boy]

He could have also created his own wifi with a hidden SSID that is not discoverable. You could use a wifi analyzer app to see if there is another hidden wifi in the house. That would be pretty definitive evidence.

[Martin Jones]

53 minutes ago, HairlessMonkeyBoy said:

Don't know, but the fact that this is the default gateway is fishy. Makes me think that the primary network is likely 192.168.1.1, and the shitty secondary that he setup for his family is on a different subnet. Slimey.

You didn't see any of his devices on the network? Also fishy...

 

He obviously created a shitty subnet for his family to use.

The thing is, when I told him to go show me on his laptop, he was connected to the same wifi as we were and his speeds were also shitty. He had this malicious smile on his face though so perhaps he did something on his phone to throttle himself down or something. Idunno. But he showed me a screen from like a month ago, where he was downloading 10+ MB/s which is like 80Mbit. On his shitty 5Mbit connection? Like bruh.

 

Yeah, I'll try to use a wifi analyzer to see if there are any hidden networks without an SSID. This was also the first thing I thought about. Though when he showed me his laptop for evidence, it didn't have any saved hidden networks and connected to the same WiFi.