Thursday 5 November · Network desk
Network
Wi-Fi, LAN, VPN and device posture for the household’s own properties.
Last sweep
16:41 · Mayfair Townhouse
Authorised scope only · fictional data
Network risk
58
Attention · 4 open findings
LAN devices
41
38 known · 2 new · 1 unknown
Wi-Fi seen
11
4 household · 1 rogue · 6 nearby
Always-on VPN
7 / 8
1 device off-tunnel
Wi-Fi networks seen
Survey at the townhouse
| SSID | Role | Security | BSSID | Ch | Signal | |
|---|---|---|---|---|---|---|
| Ashcombe-Mayfair | Household | WPA3-Enterprise | B4:FB:E4:1A:90:10 | 36 | −38 dBm | Known |
| Ashcombe-Staff | Household | WPA3 | B4:FB:E4:1A:90:11 | 36 | −40 dBm | Known |
| Ashcombe-IoT | Household | WPA2 | B4:FB:E4:1A:90:12 | 1 | −42 dBm | WPA2 |
| Ashcombe-Guest | Household | WPA3 | B4:FB:E4:1A:90:13 | 1 | −44 dBm | Known |
| Ashcombe-Mayfair | Evil twin | Open | 02:18:4A:77:C2:9E | 6 | −41 dBm | Rogue |
| BT-Hub6-7FQ9 | Neighbour | WPA2 | A4:B1:C1:··:··:2C | 11 | −71 dBm | Nearby |
| VM1234567 | Neighbour | WPA2 | C0:05:C2:··:··:81 | 6 | −76 dBm | Nearby |
The rogue copy of Ashcombe-Mayfair appeared at 16:18, close-in, with no encryption and a locally administered BSSID. It is not on the household allow-list. Steward notified. Neighbour SSIDs are noted only as seen from the property.
New or unknown
3Rogue AP16:18
Evil twin of Ashcombe-Mayfair
Open network, same name, unknown radio. Auto-VPN-on-join kept enrolled devices on the house tunnel. No household device associated with it.
New device15:52
Apple device · 10.12.30.47
First seen on staff VLAN. Vendor Apple. Awaiting steward confirm or quarantine.
Unknown14:07
No vendor · 10.12.40.91
Randomised MAC on the IoT VLAN. Isolated. Not yet claimed.
LAN inventory
Mayfair · 41 addresses · ARP and nmap
| Name | Type | IP | MAC vendor | First seen | Last seen | |
|---|---|---|---|---|---|---|
| ashcombe-gw | Gateway | 10.12.10.1 | Ubiquiti | 12 Jan 2025 | 16:40 | Known |
| ashcombe-01 | Server | 10.12.10.10 | Apple | 3 Mar 2026 | 16:40 | Known |
| E. Ashcombe · MacBook | Laptop | 10.12.10.21 | Apple | 3 Mar 2026 | 16:39 | Known |
| E. Ashcombe · iPhone | Phone | 10.12.10.22 | Apple | 3 Mar 2026 | 16:39 | Known |
| H. Ashcombe · iPhone | Phone | 10.12.10.23 | Apple | 8 Apr 2026 | 16:38 | Known |
| Conservatory cam | Camera | 10.12.50.14 | Hikvision | 12 Jan 2025 | 16:40 | Known · risk |
| Garden cam west | Camera | 10.12.50.18 | Hikvision | 12 Jan 2025 | 16:40 | Known · Telnet |
| Unclaimed Apple | Phone | 10.12.30.47 | Apple | 5 Nov 15:52 | 16:39 | New |
| — | IoT | 10.12.40.91 | Unknown | 5 Nov 14:07 | 16:21 | Unknown |
| Staff kitchen iPad | Tablet | 10.12.30.18 | Apple | 2 Feb 2026 | 14:27 | Known · off VPN |
Open ports and risky services
2 findings
High
Telnet on garden cam west
10.12.50.18 · tcp/23 · old service, should be disabled
Medium
Camera admin page on HTTP
10.12.50.14 · tcp/80 · reachable from the staff VLAN
Clear
No WAN management on the gateway
ashcombe-gw · WAN ports 22, 80, 443 closed from outside
Firmware and patches
2 dueashcombe-gw · UniFi4.1.13 · current
Mayfair AP · downstairs6.6.77 · current
Conservatory cam5.6.2 · 5.7.1 available
Garden cam westEOL firmware · replace
Door station2.4.10 · current
Replacements and updates wait on the Principal’s sign-off. Nothing is pushed without it.
IoT segmentation and VLANs
1 leakTrusted · 10.12.10.0/24Healthy
Staff · 10.12.30.0/24Healthy
IoT · 10.12.40.0/24Isolated · no route to Trusted
Cameras · 10.12.50.0/24HTTP 80 visible from Staff
Guest · 10.12.90.0/24Client isolation on
Camera VLAN should not answer the staff network on port 80. Rule change drafted, not applied.
Always-on VPN
WireGuard to the house
E. Ashcombe · iPhone
Endpoint ashcombe-gw · Mayfair
E. Ashcombe · MacBook
Endpoint ashcombe-gw · Mayfair
H. Ashcombe · iPhone
Endpoint ashcombe-gw · Mayfair
C. Ashcombe · iPhone
Endpoint ashcombe-01 · uk-south · roaming
A. Ashcombe · iPhone
Endpoint ashcombe-01 · uk-south
J. Hale · iPad
Endpoint ashcombe-gw · Mayfair
Travel laptop
Endpoint ashcombe-01 · uk-south
Staff kitchen iPad
Last handshake 14:27 · still on staff Wi-Fi
Wi-Fi join checks
Every new network a device joins
| When | Device | SSID joined | Check | Policy | |
|---|---|---|---|---|---|
| 16:22 | C. Ashcombe · iPhone | Ashcombe-Mayfair · open copy | Evil-twin match | Did not associate · VPN held | Blocked |
| 15:10 | A. Ashcombe · iPhone | Swisscom_Public | Captive portal | Auto-VPN to ashcombe-01 | Tunnel on |
| 14:48 | Travel laptop | Farnborough-Guest | Open network | Auto-VPN to ashcombe-01 | Open · VPN on |
| 11:04 | E. Ashcombe · iPhone | Ashcombe-Mayfair | Allow-listed · WPA3 | House SSID · tunnel optional | Known |
Open, WEP, evil-twin and captive-portal networks force the always-on tunnel. WEP has not been seen this week. House SSIDs on the allow-list do not need the VPN while the device is on site.
Device posture
Jamf · Intune · 16:35| Device | OS patch | Disk encryption | MDM | |
|---|---|---|---|---|
| E. Ashcombe · MacBook | macOS 26.1 | FileVault on | Jamf enrolled | Pass |
| E. Ashcombe · iPhone | iOS 26.1 | Encrypted | Jamf supervised | Pass |
| H. Ashcombe · iPhone | iOS 26.1 | Encrypted | Jamf supervised | Pass |
| C. Ashcombe · iPhone | iOS 26.1 | Encrypted | Jamf supervised | Pass |
| A. Ashcombe · iPhone | iOS 26.0 | Encrypted | User Enrollment | Watch |
| Travel laptop | Windows 11 25H2 | BitLocker on | Intune enrolled | Patch due |
| Staff kitchen iPad | iPadOS 18.6 | Encrypted | Not enrolled | Fail |
Scan schedule
On-site onlyLAN inventoryEvery 5 min
Wi-Fi surveyEvery 15 min
Device postureEvery 30 min
Camera / IoT checksDaily 16:00
Vulnerability sweepWeekly · Sun 03:10
History
Wi-Fi survey
Evil twin still present
LAN ARP / nmap
41 hosts · 1 unknown
Posture pull
1 not enrolled
Nuclei · camera VLAN
HTTP admin · Telnet
Greenbone weekly
No new WAN findings