1

From a Windows 7 box, connected to what should be a private network, what is the best / most foolproof approach to detecting a connected router? The end-goal is to prevent the private network from ever being connected to any other network and so, upon detecting a connected router, the workstations will be shut down.

I thought about using ICMP router discovery, but that imposes a reliance on ICMP being enabled on the routers (don't admins generally disable ICMP to prevent attacks?). Thought about maybe just doing a tracert to 8.8.8.8 and parse the output. I don't yet have a test setup so am just researching at this point, trying to come up with a design. Dr Google has not come up with much beyond the usual "how do I find my router's IP" responses.

8
  • 2
    By "The end-goal is to prevent the private network from ever being connected to any other network and so, upon detecting a connected router" do you mean detecting a Rogue router on a network ? Can you reformulate your question. I think you are looking for a network scanner like nmap to discover devices inadvertently connected. An interesting command for you so : nmap -sS -O 172.16.X.0/24 -oG nmap_172_16_X . Here an interesting cheat sheet to explore nmap hackingdefined.org/publications/nmap-cheat-sheet.pdf
    – cgasp
    Commented Jun 2, 2014 at 14:11
  • FRom the POV of preserving the disconnected nature of the private LAN, I suppose any connected router would be considered a rogue. It's not so much detecting rogue wifi routers that folks may attach so they can use their ipads and laptops, it's more to catch the connections to corporate networks which themselves, could be compromised. I suppose it's all the same in the end.
    – Jon
    Commented Jun 2, 2014 at 14:31
  • If you cant control network devices, you cant guarantee isolation of the network. In the wild, it is a lot of attack vectors on the infrastructure and... (ta-dam) misconfigurations ;-) In your situation, i agree with @cdq74cn: try to use active detection - network scanners
    – pyatka
    Commented Jun 2, 2014 at 16:28
  • I would say that ultimately there is no way to guarantee detection of a router connected to the private network. There is no requirement that a router "advertise" itself in any way, nor is it required to respond to any sort of probe/scan attempt. If you are intent on keeping this private network "disconnected" and secure, you will have to look at other ways to secure the network other than detection of a rogue router...for instance 802.1X, port security, etc.
    – YLearn
    Commented Jun 2, 2014 at 19:21
  • @jon, please explain how you would use the information we might provide. Even with the last comment, what you are trying to accomplish is somewhat vague. Are you securing a network, or writing software to detect certain conditions, or??? Commented Jun 3, 2014 at 1:00

4 Answers 4

1

Using a sniffer to identify traffic normally generated by routers (OSPF,RIP,VRRP,etc) could help with this task. As you mention, looking for ICMP router advertisements would not hurt either. Also you can configure the switches to send traps when a port comes up. Then you can check the MAC address learned on that port and have an idea of what type of device was connected to the network.

1

802.1x-2004 supports EAP Mutual Authentication. Clients could be configured to block the network access if authentication fails.

It can be used to prevent your clients from connecting to unwanted network but also helps keeping unwanted visitors out of you network as well.

0

Have the system request (but not accept) a new IP address via DHCP every few minutes, and if it gets an offer from an unfamiliar source, that's your rogue router.

You may want to look at using Scapy to generate and process the "fake" DHCP packets.

6
  • Most routers aren't providing DHCP services unless you are including "home gateway devices" as routers.
    – YLearn
    Commented Jun 2, 2014 at 22:02
  • Rogue routers typically are "home gateway devices" which some "power user" brought in to solve their own problems (while creating more problems for you). Any other kind of rogue router (set up by someone who knows what they're doing) is probably going to be totally invisible to you anyway.
    – sburlappp
    Commented Jun 2, 2014 at 22:22
  • While your statement may be true generally, the OP doesn't seem to be primarily concerned about home gateway devices since he mentions admins disabling ICMP (which is not often a feature of home gateway devices - especially when you are connected to the internal interfaces where you would see DHCP).
    – YLearn
    Commented Jun 3, 2014 at 1:27
  • That's true, but if they're intentionally hiding the router, you're pretty much stuck. Nothing short of a search of the MAC address tables on every switch in the network will show that they're present - I use NetDisco for that, it works pretty well for a free tool.
    – sburlappp
    Commented Jun 3, 2014 at 13:17
  • I suspect it won't be that devious... it'll more likely be a simple connection to a corporate network which should appear somewhat available, would it not?
    – Jon
    Commented Jun 3, 2014 at 14:05
0

I ended up taking a few of the hints here and crafting a solution which seems to work. I have to operate on the assumption that, anything outside the box is a potential point of attack - we might be able to configure a switch, for example, but there is no guarantee that it will remain that way forever. So, we cannot rely on the configuration of external devices to assist.

I would up creating a monitoring program which monitors the box's own configuration and listens on the wire for anomalies, shutting down the nic if anything out of the ordinary is detected.

1
  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin
    Commented Aug 17, 2017 at 15:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.