Anti-ISP blocking! How to deal with network Vanguard

Recently, ISP providers are increasingly blocked, further infringing the interests of users. ISP providers usually use a monitoring software called "Network Vanguard" to shield routing. I have found a method for cracking. You can try it. "Network Vanguard" is to use multiple methods to detect whether users use the Internet sharing mode to restrict access. Here I will crack them separately:
　　
1. check whether there are different MAC addresses in the packets with the same IP address. If so, determine that the user shares the internet. The solution is to change the MAC address of each server to the same one. There are many ways to modify the address as follows:
　　
(1) crossing the sea
1. Modify the Registry
Almost all Nic drivers can be called by the NdisReadNetworkAddress parameter to read a user-specified MAC address from the registry. When the driver determines that the MAC address is valid, it will program the MAC address to the hardware register, ignoring the fixed MAC address of the network card. We can achieve this by manually modifying the Windows registry.
Run the Windows Registry Editor under Winodws 98 and expand "HKEY_LOCAL_MACHINE \ System \ Current ControlSet \ Services \ Class \ Net ", the subkeys similar to "0000", "0001", and "0002" are displayed. Click the "0000" subkey and search for the "DriverDesc" key under the subkey until you find the NIC registry information that is exactly the same as the target.
After the correct Nic is found, click "Edit/New/string" in the drop-down menu, and the name of the string is "Networkaddress ", double-click the name of the newly created "Networkaddress" string to enter a value. Enter the new MAC address value you want to specify. The new MAC address should be a 12-digit hexadecimal number or letter with no "-", such as "000000000000" (note, in Windows 98 and Windows 2000/XP, the specific key value location is slightly different. You can find it through the search function ).
Add a string value named "ParamDesc" under "NetworkAddress", which is used as the description of "NetworkAddress". The value can be set to "MAC Address ". Modify the content you want to set .. In this way, we have successfully modified the MAC address of the NIC and restarted the computer.
　　
2. Modify Nic attributes
Most NICs can change their MAC addresses by modifying the NIC attributes in the control panel. In "Device Manager", right-click the NIC icon to change the MAC address, and select the "properties/advanced" tab. In the "attribute" area, you can see a project called "Network Address" or another similar name. Click it and at the bottom of the "value" on the right, enter the MAC address to be specified. You must enter 12 hexadecimal numbers or letters consecutively. Do not enter "-". After the system is restarted, the setting takes effect.
　　
(2) pay-as-you-go
　　　
If you are using the RealTek RTL8139A/B/C/D chip Nic, there is a simpler way to modify the MAC address. The PG8139 software designed by RealTek can directly modify the MAC address of the RTL8139 series Nic, or even make the MAC address of the NIC different after each startup. The procedure is as follows:
Decompress pg8139.zip to a folder. Take the 8139C chip as an example. use NotePad to open 8139c in this directory. cfg file, modify 8139c. in the first line of the cfg file, change "NodeID" (network card number) to the required new value. We recommend that you set the initial value to "00 E0 4C 00 01 ", note that at least one space is required for each two digits.
　　
Save and enter the MS-DOS mode (note, in pure DOS mode), enter "pg8139/pci 8139c. cfg "and then press the Enter key. If the system prompts" Programming EEPROM is successful ", the change is successful. Each time the PG8139 program runs successfully. in the cfg file, the system automatically adds the value of "NodeID" to 1, that is, the MAC address assigned to the NIC of the current workstation at the first run is "00 E0 4C 00 00 01 ", during the second operation, the system will automatically allocate "00 E0 4C 00 00 02". During the third operation, will automatically be "00 E0 4C 00 00 03 "......, in this way, you can modify the MAC address of the network card in batches. You do not need to modify the 8139c repeatedly. cfg file.
If the user's Nic is another version of RTL8139 chip, you only need to find the corresponding. cfg file to modify it.
In addition, there is an extreme way to clone the MAC address by burning the EEPROM of the NIC. However, this operation is highly risky and complicated. Even experienced users may encounter errors during the operation. We do not recommend this operation.
　　
(3) Learn from Dongfeng
If you are a Windows 2000/XP user, you can use the free MAC address to modify the software SMAC. After running SMAC, the list box in the window lists the network adapters that are currently working on the computer. After selecting the NIC to be modified, enter a new MAC address in the six input boxes below the list box, and click "Update MAC (modify MAC address)" on the right )", you can modify the MAC address.
　　
There are many tools to modify the MAC address, but most of them only apply to Windows 2000/XP. We recommend that you use "Super Rabbit magic Settings" because it is not only easy to use, it is also valid in Windows 9x.
After the modification is complete, you can restart the system to make the settings take effect. You do not need to restart the system. In Device Manager, right-click the network adapter icon and select disable, whether the status bar is "disabled "). Right-click the selected network adapter and choose enable from the shortcut menu ". In this way, the modified settings will take effect.
　　
　　
Ii. SNMP (Simple Network Management Protocol) is used to discover multi-host internet access.
　　
Some routers and ADSL cats have built-in SNMP services. You can use corresponding tools to check whether users share them. The following is a user-provided tool to check the number of connected users in an adsl modem, the number of shared users is clearly displayed.
　　
If you want to know whether your router or big cat has enabled the SNMP service, you can find a scanning software (ipscan, superscan ......) scan. If port 161 is enabled, there is a built-in SNMP service. The solution is to use SNMP? Disable Port 61.
If you use a vro or enable the ADSL Cat's route mode to share the Internet, you can go to the management interface and turn it off with the SNMP option. If the management interface of the cat has no options to disable SNMP had to buy a router without SNMP service, such as TP-LINK TL-R400, put in the middle of adsl moden and hub, in the router to do a NAT service, in this way, an address is entered into the ADSL cat, which solves the problem of Internet sharing.
　　
3. Monitor the number of concurrent ports. If the number of concurrent ports exceeds the set number, it is determined to be shared.
　　
This is an unpleasant setting. "Network Vanguard" constantly scans the number of ports opened by users. If it is more than the set value, it will be shared, sometimes, when you press the F5 key several times, it is considered to be shared, and a single user is also affected to access the Internet. This cannot be cracked (unless you have hacked the network ), the solution here is to install an innocent user to call the ISP's customer service, and declare that the ISP will be changed if the problem is not solved, and the network will be normal in a short time;
4. "Network Vanguard" also uses an unknown method to test shared information from the shared computer. The solution is to install a firewall on all shared clients, set the security level to the highest, and do not permit all rules in the IP configuration rules to allow others to access the local machine, allow PING to the local machine, and prevent ICMP attacks. Select the same option for IGMP attacks. If it is WINXP, open the network firewall of the NIC. After the above method is used, the local machine cannot be seen in the local area network, and after WINXP opens the network firewall of the NIC, files cannot be transmitted on QQ, and the network speed slows down, but it can be shared again.