34 votes

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a ...
user avatar
  • 94.1k
26 votes
Accepted

Do I need to set the enable secret on Cisco device?

No, you don't -- technically. But whether you can enter enable mode without one depends on how you log in. Here's the instant gratification version: You can enter via the console without an enable ...
user avatar
21 votes
Accepted

What are the benefits and cons of IGMP snooping?

IGMP Snooping is a feature for switches to learn what multicast groups are needed on which ports. Routers not handling multicast routing don't care. That said, without an mrouter in the network, you ...
user avatar
  • 29.7k
15 votes
Accepted

Why should the native VLAN never be used?

You can and most likely will need to use a native VLAN on your trunk ports, at least on Cisco switches, other vendors do it differently. But what you have to remember that the security risk is more to ...
user avatar
  • 1,996
13 votes

How to verify that a UDP port is open?

UDP is obviously a send-and-forget protocol. For example, during an NMap UDP scan, the only way to definitively prove that a UDP port is open is if you receive a response from that port. Keep in mind ...
user avatar
  • 445
13 votes

How to verify that a UDP port is open?

This is a quick recipe: 1) Start a packet sniffer: sudo tcpdump -n -i eth2 icmp & [1] 1409 $ tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth2, link-...
user avatar
  • 1,626
12 votes
Accepted

IPv6 and online privacy and security

Let's look at a live example. This being from my Linux workstation. (And for simplicity I actually omitted a couple of addresses.) I'll explain each of the addresses in turn: $ ip a s dev br0 3: br0: &...
user avatar
10 votes
Accepted

What's the difference between RADIUS and 802.1X Port-Based Authentication?

That's a lot of questions, so let's take them one by one. What exactly is 802.1X Port-Based Authentication? From Wikipedia : IEEE 802.1X is an IEEE Standard for port-based Network Access Control ...
user avatar
  • 2,628
9 votes
Accepted

Locked myself out of my Cisco switch

If you didn't save the configuration, you could just restart the switch, but you will need physical access to the switch. You may be able to get someone at the site to restart the switch for you. ...
user avatar
  • 94.1k
9 votes

Mitigating 802.1x bypass by transparent bridging

Frankly, no. 802.1X authenticates the port and as long as it is authenticated it participates in the network. Inserted or even modified frames by an otherwise transparent network device cannot be ...
user avatar
  • 71.7k
8 votes
Accepted

whois 243.25.203.20

As @tripleee said in his comment, looks like it is an IP from a reserved block, so it should not be public routable on the Internet (in an ideal world, that is :D). You can check by specifying an ...
user avatar
7 votes

Cisco ASA 8.2(5) same security routing issue

Without the use of same-security, traffic will not flow between interfaces at the same security level. That's the way it's designed, and the very purpose of those commands. No amount of ACLs can ...
user avatar
  • 29.7k
7 votes
Accepted

Per-user network authentication without mac-filtering

I am aware of MAC address filtering available on most WiFi routers, but this is about access control on a device by device basis. One user may have many devices. Is there any way to control WiFi ...
user avatar
7 votes
Accepted

Configuring a password policy on Cisco IOS or NX-OS

Regarding password complexity for local accounts, you have these options... Cisco NX-OS: I'm not sure you can configure a local password policy in NX-OS; however, NX-OS rejects weak passwords by ...
user avatar
7 votes

How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?

Use a VPN internally and treat the section of the network outside secure areas the same way you would treat the internet.
user avatar
7 votes
Accepted

How do we prevent loss of sensitive information from MAC spoofing?

MAC spoofing is more about LAN disruption than stealing information. I think you have a mistaken idea about routers. Routers do not route to MAC addresses, and on a LAN, a router is simply another ...
user avatar
  • 94.1k
7 votes
Accepted

Why my computer is making this ARP requests to external (Gov) IP addresses?

169.254.0.0/16 is reserved for link-local addresses as per RFC 3927. Link-local address space is used when there is no authority for IP address control (DHCP or static configuration). Some device with ...
user avatar
  • 71.7k
7 votes
Accepted

What is the difference between "Message Digest" and Checksum?

A checksum is the general term used. A checksum can range from a check digit (parity bit) to a complex output string. Different checksums (examples below) can be chosen depending on the application. ...
user avatar
  • 316
7 votes
Accepted

Why can't I get a WiFi password by sending out the same SSID?

Assuming you are talking about a PSK wireless network, then you misunderstand what is actually taking place. The PSK isn't sent from a client to the AP. Rather it is a common starting point from ...
user avatar
  • 26.8k
7 votes
Accepted

Run MACsec and VLAN in parallel?

Welcome to Network Engineering! There is no standard for MACSec and 802.1Q, so manufacturers have come up with their own solutions. Cisco calls it "WAN MACSec," and does it this way: The WAN ...
user avatar
  • 63k
7 votes
Accepted

Lost Ethertype in encrypted MACsec frames

MACsec actually adds to the ethernet frame header and trailer. You end up with a different value in the Ether Type field position, much like you do with 802.1Q, but the original Ether Type field is ...
user avatar
  • 94.1k
7 votes
Accepted

Is this computer a threat? On same network range, but in a workgroup

The situation you describe is very similar to what cost Target* many millions of dollars when its network was hacked, and customer information was stolen. Never let another company have something ...
user avatar
  • 94.1k
6 votes
Accepted

Toggle Switch for an Ethernet Cable

Have you got a physical switch that is rated for Cat5 cabling? The answer to your question is the same as the answer to my question. More than likely you need to buy an electronic relay, and I know ...
user avatar
6 votes
Accepted

Can you only allow local login when TACACS is unavailable on a Juniper?

This is actually default behavior. The only way a local login will even be attempted is if all other authentication types fail (TACACS and/or RADIUS). So in your case, the only time your local ...
user avatar
  • 6,450
6 votes

Must a broadcast request come from the same network?

Broadcasts do not normally cross layer-3 (routers). Some routers can be configured to forward subnet broadcasts, but the limited broadcast (255.255.255.255) will not cross layer-3. The Cisco version ...
user avatar
  • 94.1k
6 votes
Accepted

IPv6 built-in security?

To be honest, it's a bit of a botched job. People (including Big Name Vendors) still look at IPSec as a means of tunneling. In IPv6, the IPSec headers were meant to allow any socket from any ...
user avatar
  • 29.7k
6 votes

How can we identify layer two device in a network or what are those device effects on a frame

Traceroute is a Layer3 technology, aka. by it's very design it'll never show anything else than the routers in path to the specific host. Traceroute works by sending packets with decreasing TTL, thus ...
user avatar
  • 2,239
6 votes
Accepted

Use of /30 instead of /31

There is no particular security advantage. RFC3021 cites addressing efficiency as the motivation for implementing /31's
user avatar
  • 63k
6 votes
Accepted

What is the characteristic of spoofed ARP packets?

If you look at the packet, there is absolutely no difference in the format of a spoofed ARP reply and a real ARP reply: they look identical. What makes a real ARP reply real? It came from the ...
user avatar
  • 15.9k
6 votes
Accepted

Does MACsec (IEEE 802.1AE) support multicast / broadcast?

MACsec provides security on the point-to-point link level. MACsec and 802.1X sit (more or less) in between the physical layer (L1) and the data link layer (L2). The key management is between the layer-...
user avatar
  • 71.7k

Only top scored, non community-wiki answers of a minimum length are eligible