Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

4
votes
1answer
227 views

Lost Ethertype in encrypted MACsec frames

MACsec uses an Ethertype of 88E5. This presents an obvious problem when encrypting frames which already have, or should have, another Ethertype. This RedHat blog, for example, states "[MACsec] can ...
1
vote
1answer
35 views

Shared secret key for Diffie-Hellman key exchange

From what i have learnt,in Asymmetric key there is public key and a private key. For instance: Step 1: Alice and Bob get public numbers P = 23, G = 9 Step 2: Alice selected a private key a = 4 and ...
3
votes
1answer
227 views

Difference between junos-host zone and a security zone

As far as security zones are concerned, we apply policies to it to control the transit traffic. And we also apply host-inbound-traffic to a zone or interfaces. If we have both of the above ...
1
vote
0answers
27 views

Dedicated Internet Router or VRF on L3? [closed]

I need to route public networks on our equipment. I plan to use existing 4500X and create a new vrf PUBLIC. There are already other vrf's existing handling internal traffic. [ISP RTR]+---/30-Network-...
3
votes
1answer
72 views

Does MACsec (IEEE 802.1AE) support multicast / broadcast?

In general, Ethernet supports both multicast and broadcast. However, once you start encrypting the payload, you need a key management. I am wondering if IEEE 802.1AE supports multicast and broadcast? ...
1
vote
1answer
30 views

Network Security Tunnel

In the Tunnel Interface, when I edit the tunnel information, it shows: Attributes Values Tunnel Source IF10 Tunnel Destination 1.0.0.1 Tunnel Mode GRE What does IF10 ...
2
votes
2answers
41 views

Use of VLAN allowed feature and security risk associated with not configuring it

if i have 3 vlans say, 10,20 ,30 if i don't assign vlan allowed to trunk port , what are the security risks i could face if i am using default vlan allowed range what are the benefits of VLAN ...
7
votes
1answer
175 views

Run MACsec and VLAN in parallel?

MACsec (IEEE 802.1ae) adds a security tag to an Ethernet frame and encrypts the IEEE 802.1Q field, the EtherType and the payload field. If you want to use VLAN, you need the 802.1Q field to announce ...
0
votes
1answer
39 views

Fortinet configuration translation [closed]

We have a small case of security breach in one of our sites, we have a contractor that is suppose to stay out of our firewall Fortinet, today i noticed these two paragraphs that look fishy. My site ...
6
votes
3answers
920 views

What is the characteristic of spoofed ARP packets?

Hi what is the characteristic of spoofed ARP packets? I want to know how to detect it but before that I have to know how can I call a packet a spoofed packet. I hope you can help me thank you.
7
votes
2answers
526 views

Mitigating 802.1x bypass by transparent bridging

The talk DEFCON talk "A Bridge Too Far" details a means to bypass wired 802.1x network access controls by setting up a transparent bridge between a genuine machine and the network. Once authentication ...
3
votes
2answers
75 views

Why can't I get a WiFi password by sending out the same SSID?

If I have two WiFi routers in different locations but with the same SSIDs and I connect a device to one of them, when I bring this device near the location of the other router, it will automatically ...
2
votes
2answers
50 views

Why are the routes taken by packets random using LPM?

Consider the Longest Prefix Matching (LPM) mechanism that routers use to decide which data link the packet should be sent next. Assuming that the router tables don't change, shouldn't the path the ...
0
votes
1answer
57 views

Why don't most routers automatically update their firmware? [closed]

Recently I realised that my new router's firmware was outdated. Searching a bit, I found out that most routers need to be manually updated to a new version of firmware. Running an old firmware could ...
7
votes
4answers
3k views

whois 243.25.203.20

I see this ip address actively accessing gmail account in spite of 2-Step Verification. whois 243.25.203.20 produces following message: No whois server is known for this kind of object. How can I ...
1
vote
1answer
61 views

Cisco ASA access list on interface on which cryptomap is applied [closed]

I am a newbie with Cisco ASA and I have a question. Thank you in advance for answering. Take a Cisco ASA that has an internet facing interface. On this interface a cryptomap is configured with some ...
0
votes
1answer
46 views

Trade Floor Network Design Feedback [closed]

I have an assignment that I am working on. Now I admit, I am far from knowledgeable and I have nowhere to turn to for help at the moment. I am not asking for someone to complete the assignment for me, ...
2
votes
2answers
72 views

Why do we allow Mac-Address to be changed by software?

In CISCO routers, they provide a provision to change the MAC-Address. My question is MAC-Address is supposed to be a burned-in address i.e. a permanent address. If we allow the mac-address to be ...
1
vote
0answers
33 views

How an MKA key server decides if it shall use MACSec and how it announce that?

According to IEEE 802.1X-2010 the standard for defining MACSec Key agreement protocol Clause 9.6, that's how the key-server decides to use MACSec or no. Each participant advertises whether it is ...
1
vote
0answers
206 views

How are required Keys inside MACSec Key agreement protocol (MKA) generated?

I am trying to wrap my head around MACSec Key agreement protocol (MKA) and its relation with MACSec and other protocols. So bear with me. To my understanding in order to MACSec to work, all nodes ...
0
votes
1answer
38 views

Implications of ipv6 on LAN security [duplicate]

I'm not sure whether this is really the correct place to post this question, because it's not really about a "professional" setting. However, I have the standard setup with computers behind a netgear ...
3
votes
0answers
189 views

Hardening Cisco router on Internet-MANAGEMENT PLANE

I need confirmation that I understood the Cisco manual right. So my network is like this: ISP_RTR ---x.x.x.x/30--- Perimeter/Edge_RTR ---y.y.y.y/30--- FW1 --- DMZ1 ...
2
votes
1answer
80 views

Can scapy specify a source IP when used to simulate SYN / UDP flood attacks

I would like to test an IDS in a test network. I know scapy can be used to generate network traffic, in particluar to simulate fake SYN flood attacks etc like the one here github. All the example ...
4
votes
1answer
167 views

Securing/Hardening Cisco router on Internet

In my company we have Cisco ASA firewall as edge device on the Internet. So outside interface with public IP address and security level 0 and inside interfaces with higher security levels. Standard ...
3
votes
1answer
247 views

How do I permit only specific types of ICMP unreachable packets to be sent out from a Cisco IOS router? [closed]

I have a Cisco IOS router and want to permit only types of ICMP packets to be sent (type 8, code 0 and type 3, code 4). I tried putting an outbound ACL on the interface connecting to the Internet, but ...
1
vote
1answer
27 views

Rogue Wireless Scanning

Is Rogue Wireless scanning required for a "wired" network? The organization does not have a wireless environment. I am just curious the reasons behind conducting the scan and what is the risk if the ...
3
votes
1answer
259 views

What is the difference between “Message Digest” and Checksum?

As far as I understand Message Digest is a certain Hash function that is derived from the original payload, so that even if a single bit changes the Message Digest proves to be different, thus ...
6
votes
3answers
400 views

Is UDP Usage in Routing Information Protocol (RIP) a Secure Practice?

I know that UDP is a connectionless transport layer protocol. Since it is easy to fake your source IP and source Port in your headers, what keeps anyone from poisoning routing tables via RIP? It seems ...
3
votes
1answer
94 views

802.1X on wired networks

Suppose i'm protection physically accessible RJ45 sockets in offices that are connected to a switch (Cisco SF220) with 802.1X port based authentication and a radius server. Authorized devices have ...
2
votes
2answers
101 views

Should my internet gateway know about internal network/vlans?

I have an internet gateway that's currently doing NAT for my internal network. With the purpose of better isolating my internal network, I'm creating VLANs on a L3 switch, and for each subnet, I have ...
2
votes
1answer
73 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
1
vote
3answers
176 views

Use of /30 instead of /31

Besides wasting IP addresses. Is there any other compelling reason to use a /31 subnet over a /30 on Point to Point links? I am interested from a security perspective mainly. Would a /31 be more ...
0
votes
1answer
49 views

Is it possible for a spy to send 100 Peta Byte of secret data securely online? [closed]

Suppose a spy in an enemy country has got access to 100 or more Peta Byte of top secret data. He wants to pass on the data to his headquarters. But he also wants to make sure that at no cost the data ...
4
votes
1answer
148 views

MAC ACL to prevent access to unauthorized computers

My company wanted to prevent rogue PCs from being connected to our network. Network access must be allowed only for our company users and specifically for PCs, Printers.. that are provided by the ...
1
vote
2answers
73 views

Separate a network within the enterprise environment

What will be the best solution, to securely separate a network and have internet connectivity. In an existing enterprise environment (Firewall, Dhcp, routers and switches) i will like to separate ...
3
votes
1answer
226 views

ACL on trunk Port

our network infrastructure as showing the image below I had to give an external company (dealing with Face recognition) software an access to both the server (172.26.33.56) and the IP Camera (172.26....
1
vote
0answers
39 views

What are some options to replace a computer that is dual homed on 2 separate VLAN's? [closed]

One is a "secure" VLAN, the other is a "house" VLAN. At some point, a workflow was developed in which a decision was made that sales staff needed to take some of their materials received from clients ...
1
vote
1answer
51 views

Sensor to collector communication from SPAN, Inline or TAP

I am trying to figure out which one of the three modes or all would support this. The sensor is a computer running fprobe and pushing UDP traffic (netflow v5) to an IP address in the network. My ...
3
votes
1answer
72 views

Example VLAN without any Router — Security Problems?

I was reading a VLAN setup walkthrough, and the author had an interesting idea for setting up VLANs without a router (which you don't normally see). At first glance, this doesn't seem like it actually ...
3
votes
1answer
80 views

How to permit behaviour in Cisco access-list commands?

If a host on a network is permitted to access another host on a different network via an ACL on the source host's router, does that automatically deny other hosts on the same network as the source ...
1
vote
1answer
104 views

Can I send an HTTP reply to users who try to access a blocked URL via the Cisco ASA?

A customer is requesting a way to send a customized reply to users who attempt to access invalid URLs via HTTP and get blocked by the ASA (v9.6). (We are currently using Regex filtering and Botnet ...
1
vote
4answers
2k views

VLANS vs. subnets for network security and segmentation

What are the security implications when using subnets as opposed to VLANs for segmenting an enterprise network? We have strict security requirements surrounding the data we handle and need to ensure ...
0
votes
1answer
55 views

D-link managed switch or Cisco managed switch? [closed]

Can anyone tell me the difference between D-link managed switch and cisco managed switch? And why we go for cisco managed switch.
1
vote
1answer
72 views

Unsecured devices and IPv6

I'm currently starting to read up on IPv6, and as soon as I heared that every device can/will have a public accessible adreess i got a little freaked out. There are a lot of horror stories about ...
1
vote
3answers
84 views

How do protocols get blocked even over open ports?

This might be a stupid question, but I'm wondering how a network blocks a protocol like SSH even if the server is listening on port that isn't blocked, like 80. I've even tried port forwarding an non-...
1
vote
0answers
113 views

Monitoring interfaces on VyOS then SSH output to another machine (Security Onion) [closed]

I am trying to figure out the best way I can monitor interfaces on a VyOS interface from a Security Onion instance using Squil (Snort alerts etc). I am thinking SSH to VyOS to activate monitor ...
1
vote
1answer
156 views

Are brute force attack on public facing interface of internet router normal?

Are brute force attacks on public facing interface of internet router normal? Enterprise Router (Cisco) with all hardening done. What can be done to stop this behavior?
4
votes
4answers
94 views

Terminals vs. Secure Access Servers?

I have come across some devices by a companay called "Lantronix" that produce 'Secure Access Servers'. The description makes it sound like they are physical devices that pretty much do what Terminal ...
2
votes
2answers
431 views

ASA traceroute from lower security level to higher security level

In following scenarios Security Level 50 (dmz-1) to Security level 75 (dmz-2) traceroute not working. I think traceroute use specific port for unreachable function but in following scenario i don't ...
2
votes
2answers
1k views

ASA not allowing ping to distinct interface IP

I have following scenario where i am trying to ping from 10.30.1.100 PC to ASA interface 10.20.1.1 not pinging but i can ping 10.20.1.100 so why ASA not allowing to ping distinct interface but ...