AC3200, what to do with it. Embarrassed!!!

[drinkingbird]

In summary, the ASUS AC3200 is a complete total piece of garbage. I feel embarrassed to have purchased it. Bought it on eBay so I'm stuck with it. It's all on me though for failing to do the research before the purchase. I just threw the damned thing into the trash.

Were you able to get into rescue mode and restore it?

 

[Tech9]

Were you able to get into rescue mode and restore it?

Access Point Question

I have a working AIMESH setup. Just playing around here but have this older (AC3200) router flashed with Merlin. It works fine but doesn't have the capability to MESH into my system. So my question is, "Can I tie this router into one of my NODES as an ACCESS POINT via an Ethernet cable?"...

www.snbforums.com

 

[drinkingbird]

Access Point Question

I have a working AIMESH setup. Just playing around here but have this older (AC3200) router flashed with Merlin. It works fine but doesn't have the capability to MESH into my system. So my question is, "Can I tie this router into one of my NODES as an ACCESS POINT via an Ethernet cable?"...

www.snbforums.com

Jeez not even a thank you.

 

[tgl]

Either they're doing WPA2-AES or they've ignored the standard and let AC speeds run over TKIP. You could probably use something like inSSIDer to see what encryption type it is for sure.

Don't have inSSIDer, but I do have Wireshark, so I pulled it out and did some sniffing. As far as I can see, all the encrypted packets going by have "CCMP parameter" fields in them, which means it's AES not TKIP right?

 

[Sgamat]

 

[drinkingbird]

Don't have inSSIDer, but I do have Wireshark, so I pulled it out and did some sniffing. As far as I can see, all the encrypted packets going by have "CCMP parameter" fields in them, which means it's AES not TKIP right?

As far as I know yes, CCMP was designed around WPA2/AES only. But are you sniffing packets to your laptop or between the two APs? I believe in WDS systems there is actually a different SSID and encryption between the units but I may be remembering that wrong.

 

[drinkingbird]

..

OK? What's that all about?

 

[tgl]

I'm seeing CCMP fields attached to both types of traffic, AFAICT. The sender/receiver labels on the packets are a bit confusing, but there is no encrypted traffic that hasn't got CCMP.

 

[Tech9]

OK? What's that all about?

The AC3200 doesn't have a repeater mode.

Seems like Repeater Mode was available in 378 firmware. Asuswrt-Merlin on 378 base is still available.

Asus 3200 repeater Mode

Hi folks, I was advised a 5300 would solve all my wifi problems in my home and whilst its fab and better than my home hub 5 (isn't anything?!?) I'm still left with weak or no wifi in the rooms at the back of the house. Asus recommended the 3200 in repeater mode and after much tooing and froing...

www.snbforums.com

@wilsonbh, do you want to try?

Asuswrt-Merlin - Browse /RT-AC3200/Release at SourceForge.net

Alternative firmware for Asus wireless routers

sourceforge.net

 

[drinkingbird]

I'm seeing CCMP fields attached to both types of traffic, AFAICT. The sender/receiver labels on the packets are a bit confusing, but there is no encrypted traffic that hasn't got CCMP.

Yeah I'm not totally sure if a standard wireless card in promiscuous mode will see the AP to AP traffic, but I've honestly never tried. I mean it is reporting that it has a decent encryption in the GUI I don't see any reason not to trust that, especially when it probably would have been more work for them to support anything other than WPA2-AES at those speeds.

 

[drinkingbird]

Seems like Repeater Mode was available in 378 firmware. Asuswrt-Merlin on 378 base is still available.

Ah, now I see what the point of the post was. Maybe a few words would have helped

Yeah forgot that someone mentioned it couldn't run repeater (which is very weird), must be something they ran into that blocked repeater, and thus AImesh as well. Considering it is going to be protected behind a router, most of the security issues with the older code are not an issue. Though hardwire on latest firmware would still be better.

 

[tgl]

Yeah I'm not totally sure if a standard wireless card in promiscuous mode will see the AP to AP traffic, but I've honestly never tried.

I definitely see packets that have to be AP-to-AP traffic. The thing that is confusing is that most of them have a "broadcast" destination address --- is that some standard's idea of security by obscurity?

 

[drinkingbird]

I definitely see packets that have to be AP-to-AP traffic. The thing that is confusing is that most of them have a "broadcast" destination address --- is that some standard's idea of security by obscurity?

No I think it is just that in that setup where you're snooping the client traffic, the only thing you're going to see for AP to AP traffic is broadcasts (which go out to all stations).

 

[tgl]

No I think it is just that in that setup where you're snooping the client traffic, the only thing you're going to see for AP to AP traffic is broadcasts (which go out to all stations).

Well ... what exactly would be the point of an encrypted broadcast packet? If you intend all stations to be able to read it, encryption is both pointless and counterproductive. I think somebody had some idea of hiding the real destination address by putting it into the encrypted part of the packet.

 

[drinkingbird]

Well ... what exactly would be the point of an encrypted broadcast packet? If you intend all stations to be able to read it, encryption is both pointless and counterproductive. I think somebody had some idea of hiding the real destination address by putting it into the encrypted part of the packet.

Once you set up encryption, everything is encrypted (other than beacons probably, and maybe some ARP requests). You want all stations to see broadcasts, but only if they are authorized in that network, so encrypting the broadcasts is a good thing, otherwise any nearby wifi device could snoop the payload. Granted there may not be anything terribly useful in the broadcasts, but there is plenty in there that a knowledgeable hacker could use to gain insight into your network, and in the case where something like MDNS or multicast streaming is in use (which is essentially broadcast traffic) you don't want unauthorized users being able to see that either.

If they were trying to mask the destination by sending it to FF:FF:FF:FF:FF:FF and hiding the actual destination inside the encrypted packet, that would cause everything to become a broadcast which would be very inefficient.