What should I do when I encounter a router or network appliance?¶

Preserve its physical connections and live display without restarting, resetting, logging in or disconnecting until its service role and volatile evidence are understood.

Record the shared system¶

Photograph device, lights, ports, cables, antennas, power and attached equipment. Capture make, model, serial, hostname, identifiers, warnings and backup power.

If management is already open, preserve account, page, time, sessions and alerts without navigating. Connection tables, DHCP, VPN, firewall and wireless records may change quickly.

Identify ownership and dependencies¶

Determine whether the provider, organisation or third party administers it and which users or safety-critical services depend on it.

Seek network or incident support for active compromise. If urgent containment cannot wait, use a narrow control and record every login, cable or state change.