Questions tagged [security]

A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access.

Filter by
Sorted by
Tagged with
0
votes
1answer
13 views

Session, presentation and application layer

I almost finished the ccna, in the meantime I'm following Pentesting courses, I noticed enough interesting protocols at the session level. I wish I could understand them as I did with cisco, but I ...
0
votes
0answers
11 views

What percent of home networks are comprised? [on hold]

By compromised I mean a hacker or some other entity is able to get on the network, look around, and interact with nodes on the network. For example it could be from a router that never had its default ...
0
votes
1answer
23 views

Is Network Bridging secure [closed]

Bridging two network cars in Windows allows the two separate networks to connect. Assuming there are three NIC cards present in a machine: A, B and C. If I bridge NIC A and B, is there a possibility ...
0
votes
0answers
23 views

How to implement port security in SDN using pox controller and ovs?

How can I defend against DHCP starvation attacks or MAC spoofing in an SDN environment?
0
votes
1answer
34 views

Multicast in enterprise network

Once I have heard from a professional that multicast is forbidden (or not suggested or not allowed) in enterprise networks from 2014. (He referenced to a standard or recommendation document or ...
1
vote
1answer
40 views

Is this computer a threat? On same network range, but in a workgroup

We have a normal on-premise Class C network with an internal IP address scheme of 192.168.15.x (hypothetical). We have a SonicWALL device that acts as a VPN server for external clients, a DHCP server ...
2
votes
1answer
91 views

Why does the Implicit Rule prevent traffic from passing?

I an testing traffic forwarding between different DMZ with different security levels. DMZ: interface GigabitEthernet0/1.351 vlan 351 nameif dmz security-level 10 ip address 10.100.20.1 255.255....
2
votes
1answer
52 views

MAC Address not resolving when IPSec VPN in place

I've created an IPSec VPN connection between two Mikrotik routers. They are connecting via IKEv2. Inside our two networks, we have a printer spooler which needs the printer's MAC address to verify it'...
1
vote
1answer
47 views

SDN Flow-modification attack

What are the steps that can be taken to prevent flow-modification attacks on an SDN controller? The attack would look as follows(As seen by the image): Does OpenDaylight or any other controller have ...
1
vote
1answer
65 views

Cisco ASA not passing traffic between two interface

I have Cisco 5506 with Security Plue License and following is my configuration. interface GigabitEthernet1/1 nameif inside security-level 100 ip address 10.0.10.1 255.255.255.0 ! interface ...
0
votes
1answer
48 views

How to change ip TTL=1 on flat network for security [closed]

Working on a network at an high rise apartment complex. They have a core router/firewall acting as dhcp server and about 7 switches (all l3 switches). They have a few vlans to segment traffic based of ...
4
votes
2answers
146 views

why do we use a layer 2 switch in a DMZ rather than a layer 3?

I've been trying to learn about DMZs. It's hard to find a technical explanation that does not dive head long into the complexities of Cisco hardware, which I'm finding confusing as I'm new to ...
-2
votes
1answer
80 views

IPSec SA being Unidirectional

From what I’ve read, IKE SAs are Birectional and IPSec SAs are unidirectional. But if the same proposals are to be agreed by both the ends, say protocol esp, Authentication algorithm as hmac-sha1-...
1
vote
1answer
44 views

Why aren't we using digital signatures for the DHCP?

Why aren't we using digital signatures for the DHCP in order to stop Rouge DHCP attacks?
1
vote
1answer
45 views

Protect Cisco C3560CX switch from unauthorized access on remote location

I have to extend our corporate lan to remote location on which we can not control the physical access to the switch. What are the best practices in this case/scenario? So, I will shut down password ...
3
votes
1answer
42 views

Why aren't we encrypting data on Network level instead of transport level when using e.g. HTTP [closed]

Why we are bothering to encrypt our data on a transport level, instead of just doing that on a network level with e.g. IPSec and get rid of the need to to that in upper layers. For example instead of ...
4
votes
1answer
283 views

Lost Ethertype in encrypted MACsec frames

MACsec uses an Ethertype of 88E5. This presents an obvious problem when encrypting frames which already have, or should have, another Ethertype. This RedHat blog, for example, states "[MACsec] can ...
1
vote
1answer
44 views

Shared secret key for Diffie-Hellman key exchange

From what i have learnt,in Asymmetric key there is public key and a private key. For instance: Step 1: Alice and Bob get public numbers P = 23, G = 9 Step 2: Alice selected a private key a = 4 and ...
3
votes
1answer
955 views

Difference between junos-host zone and a security zone

As far as security zones are concerned, we apply policies to it to control the transit traffic. And we also apply host-inbound-traffic to a zone or interfaces. If we have both of the above ...
1
vote
0answers
32 views

Dedicated Internet Router or VRF on L3? [closed]

I need to route public networks on our equipment. I plan to use existing 4500X and create a new vrf PUBLIC. There are already other vrf's existing handling internal traffic. [ISP RTR]+---/30-Network-...
3
votes
1answer
235 views

Does MACsec (IEEE 802.1AE) support multicast / broadcast?

In general, Ethernet supports both multicast and broadcast. However, once you start encrypting the payload, you need a key management. I am wondering if IEEE 802.1AE supports multicast and broadcast? ...
1
vote
1answer
33 views

Network Security Tunnel

In the Tunnel Interface, when I edit the tunnel information, it shows: Attributes Values Tunnel Source IF10 Tunnel Destination 1.0.0.1 Tunnel Mode GRE What does IF10 ...
2
votes
2answers
47 views

Use of VLAN allowed feature and security risk associated with not configuring it

if i have 3 vlans say, 10,20 ,30 if i don't assign vlan allowed to trunk port , what are the security risks i could face if i am using default vlan allowed range what are the benefits of VLAN ...
6
votes
1answer
527 views

Run MACsec and VLAN in parallel?

MACsec (IEEE 802.1ae) adds a security tag to an Ethernet frame and encrypts the IEEE 802.1Q field, the EtherType and the payload field. If you want to use VLAN, you need the 802.1Q field to announce ...
0
votes
1answer
40 views

Fortinet configuration translation [closed]

We have a small case of security breach in one of our sites, we have a contractor that is suppose to stay out of our firewall Fortinet, today i noticed these two paragraphs that look fishy. My site ...
6
votes
3answers
944 views

What is the characteristic of spoofed ARP packets?

Hi what is the characteristic of spoofed ARP packets? I want to know how to detect it but before that I have to know how can I call a packet a spoofed packet. I hope you can help me thank you.
7
votes
2answers
827 views

Mitigating 802.1x bypass by transparent bridging

The talk DEFCON talk "A Bridge Too Far" details a means to bypass wired 802.1x network access controls by setting up a transparent bridge between a genuine machine and the network. Once authentication ...
3
votes
2answers
84 views

Why can't I get a WiFi password by sending out the same SSID?

If I have two WiFi routers in different locations but with the same SSIDs and I connect a device to one of them, when I bring this device near the location of the other router, it will automatically ...
2
votes
2answers
55 views

Why are the routes taken by packets random using LPM?

Consider the Longest Prefix Matching (LPM) mechanism that routers use to decide which data link the packet should be sent next. Assuming that the router tables don't change, shouldn't the path the ...
0
votes
1answer
62 views

Why don't most routers automatically update their firmware? [closed]

Recently I realised that my new router's firmware was outdated. Searching a bit, I found out that most routers need to be manually updated to a new version of firmware. Running an old firmware could ...
7
votes
3answers
3k views

whois 243.25.203.20

I see this ip address actively accessing gmail account in spite of 2-Step Verification. whois 243.25.203.20 produces following message: No whois server is known for this kind of object. How can I ...
1
vote
1answer
109 views

Cisco ASA access list on interface on which cryptomap is applied [closed]

I am a newbie with Cisco ASA and I have a question. Thank you in advance for answering. Take a Cisco ASA that has an internet facing interface. On this interface a cryptomap is configured with some ...
0
votes
1answer
55 views

Trade Floor Network Design Feedback [closed]

I have an assignment that I am working on. Now I admit, I am far from knowledgeable and I have nowhere to turn to for help at the moment. I am not asking for someone to complete the assignment for me, ...
3
votes
2answers
114 views

Why do we allow Mac-Address to be changed by software?

In CISCO routers, they provide a provision to change the MAC-Address. My question is MAC-Address is supposed to be a burned-in address i.e. a permanent address. If we allow the mac-address to be ...
1
vote
0answers
90 views

How an MKA key server decides if it shall use MACSec and how it announce that?

According to IEEE 802.1X-2010 the standard for defining MACSec Key agreement protocol Clause 9.6, that's how the key-server decides to use MACSec or no. Each participant advertises whether it is ...
1
vote
0answers
501 views

How are required Keys inside MACSec Key agreement protocol (MKA) generated?

I am trying to wrap my head around MACSec Key agreement protocol (MKA) and its relation with MACSec and other protocols. So bear with me. To my understanding in order to MACSec to work, all nodes ...
0
votes
1answer
76 views

Implications of ipv6 on LAN security [duplicate]

I'm not sure whether this is really the correct place to post this question, because it's not really about a "professional" setting. However, I have the standard setup with computers behind a netgear ...
5
votes
1answer
281 views

Hardening Cisco router on Internet-MANAGEMENT PLANE

I need confirmation that I understood the Cisco manual right. So my network is like this: ISP_RTR ---x.x.x.x/30--- Perimeter/Edge_RTR ---y.y.y.y/30--- FW1 --- DMZ1 ...
2
votes
1answer
152 views

Can scapy specify a source IP when used to simulate SYN / UDP flood attacks

I would like to test an IDS in a test network. I know scapy can be used to generate network traffic, in particluar to simulate fake SYN flood attacks etc like the one here github. All the example ...
4
votes
1answer
232 views

Securing/Hardening Cisco router on Internet

In my company we have Cisco ASA firewall as edge device on the Internet. So outside interface with public IP address and security level 0 and inside interfaces with higher security levels. Standard ...
3
votes
1answer
606 views

How do I permit only specific types of ICMP unreachable packets to be sent out from a Cisco IOS router? [closed]

I have a Cisco IOS router and want to permit only types of ICMP packets to be sent (type 8, code 0 and type 3, code 4). I tried putting an outbound ACL on the interface connecting to the Internet, but ...
1
vote
1answer
33 views

Rogue Wireless Scanning

Is Rogue Wireless scanning required for a "wired" network? The organization does not have a wireless environment. I am just curious the reasons behind conducting the scan and what is the risk if the ...
4
votes
1answer
545 views

What is the difference between “Message Digest” and Checksum?

As far as I understand Message Digest is a certain Hash function that is derived from the original payload, so that even if a single bit changes the Message Digest proves to be different, thus ...
6
votes
3answers
583 views

Is UDP Usage in Routing Information Protocol (RIP) a Secure Practice?

I know that UDP is a connectionless transport layer protocol. Since it is easy to fake your source IP and source Port in your headers, what keeps anyone from poisoning routing tables via RIP? It seems ...
3
votes
1answer
123 views

802.1X on wired networks

Suppose i'm protection physically accessible RJ45 sockets in offices that are connected to a switch (Cisco SF220) with 802.1X port based authentication and a radius server. Authorized devices have ...
2
votes
2answers
121 views

Should my internet gateway know about internal network/vlans?

I have an internet gateway that's currently doing NAT for my internal network. With the purpose of better isolating my internal network, I'm creating VLANs on a L3 switch, and for each subnet, I have ...
2
votes
1answer
78 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
1
vote
3answers
240 views

Use of /30 instead of /31

Besides wasting IP addresses. Is there any other compelling reason to use a /31 subnet over a /30 on Point to Point links? I am interested from a security perspective mainly. Would a /31 be more ...
0
votes
1answer
51 views

Is it possible for a spy to send 100 Peta Byte of secret data securely online? [closed]

Suppose a spy in an enemy country has got access to 100 or more Peta Byte of top secret data. He wants to pass on the data to his headquarters. But he also wants to make sure that at no cost the data ...
4
votes
1answer
188 views

MAC ACL to prevent access to unauthorized computers

My company wanted to prevent rogue PCs from being connected to our network. Network access must be allowed only for our company users and specifically for PCs, Printers.. that are provided by the ...