Wireless router behaviour

  We recently suffered an intrusion attempt on our
internal network.  (Details aren't relevant to my
question....)

  We traced the source back to an unauthorized wireless
router (D-Link 714P+, if it matters) plugged into a 
live but unused network jack in a barely-accessible
location.
  Before we had found the device, or ascertained its
type, we were able to sniff the switch port it was on,
and observed that it was pinging the network gateway
about once per second.

  That doesn't sound like normal router behaviour to me.
Has anyone else seen such a device do this?  Is this
something the intruder did to the router?  (We have 
suspicion, but not actual certainty, that the router
was placed by the same intruder as executed the network
attacks.  So the attacker may have had to first compromise
the router to get access.)

Dave Gillett