0

This may be a dumb question but I really don't get it.

Let's assume we have two networks. Network A and B. They have the following devices:

  • Network A
    • Device X (IP: 192.168.0.10; subnet mask: 255.255.255.0)
  • Network B
    • Device Y (IP: 192.168.1.11; subnet mask: 255.255.0.0)
    • Device Z (IP: 192.168.0.10; subnet mask: 255.255.0.0)
  • Router that connects A and B

This works out when Device X would send something to Device Y because X would notice that Y is not in his network and would send his message to the gateway. But when Y wants to answer X's message, Y will think that X is in his network because of his subnet mask (255.255.0.0). That would not only be an error but also a security problem because now Z would receive the answer that was intended for X.

Edit: Is this correct? Is this a serious security flaw?

7
  • 1
    Not sure what your question is, but your description is essentially correct.
    – Ron Trunk
    May 4 at 16:47
  • 1
    That is not a security flaw, it is a design/implementation flaw that breaks communication, not security.
    – Ron Maupin
    May 4 at 16:55
  • @RonTrunk What do you mean by "essentially"? Could this be used by an attacker? May 4 at 16:56
  • @RonMaupin I see May 4 at 16:58
  • Yes (correct) and no (security flaw).
    – Zac67
    May 4 at 17:01
0

The only flaw here is in configuration.

192.168.0.0/24 is a subnet of 192.168.0.0/16, creating a network address collision. This in turn creates the routing error you're describing, in combination with an additional end-address collision (duplicate 192.168.0.10).

IP addresses need to be unique for routing to work. If you connect two networks with overlapping addressing, that overlap needs to be removed by renumbering one of them. If you can't renumber by any means, you could choose to use NAT with different addressing domains (opening a can of worms).

Of course, if you let an unauthorized party reconfigure your network like that'd be an obvious security issue (letting the attacker in). There are countless ways to attack hosts in a network once you're "in" - what you're describing is just one of them. The point of network security is to not let anyone in that you don't want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.