What should I do when I encounter a router or network appliance?¶

A router or network appliance may contain live connection, configuration and security evidence that changes quickly.

Avoid this assumption: It is only supporting equipment and can be restarted, unplugged or reset without consequence. It may hold active connection tables, DHCP records, firewall alerts, VPN sessions, wireless clients and temporary logs.

First, record the appliance as found. Photograph the whole device, display, status lights, labels, ports, cables, antennas, power supplies and connected equipment.

Capture the make, model, serial number, asset tag, hostname and any visible network identifiers.

Note whether it is powered, showing warnings, connected to backup power or linked to several networks.

Do not restart, reset or press unfamiliar buttons.

Do not disconnect cables simply to identify them. One cable may support several evidential systems, users or critical services.

If a management interface is already open, record the visible page, account, time, alerts and connection state without navigating unnecessarily.

Identify who owns and administers the appliance and what services depend on it.

Where an active cyber incident, public-safety system or business-critical network is involved, seek network or incident-response support immediately.

If urgent containment is necessary, use the narrowest effective action and record why delay was not reasonable.

Document every interaction, cable change, login, shutdown or transfer.

Record whether the appliance is supplied by an internet provider, owned by the organisation or managed by a third party, because responsibility for logs, configuration and preservation may sit elsewhere.

Operational takeaway¶

Treat a router or network appliance as a live shared evidential system, preserve its physical and visible state and avoid restart, reset or disconnection without specialist assessment.