34
votes
How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?
MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a ...
- 98.3k
16
votes
Accepted
Why should the native VLAN never be used?
You can and most likely will need to use a native VLAN on your trunk ports, at least on Cisco switches, other vendors do it differently. But what you have to remember that the security risk is more to ...
- 2,016
13
votes
How to verify that a UDP port is open?
UDP is obviously a send-and-forget protocol. For example, during an NMap UDP scan, the only way to definitively prove that a UDP port is open is if you receive a response from that port. Keep in mind ...
- 445
13
votes
How to verify that a UDP port is open?
This is a quick recipe:
1) Start a packet sniffer:
sudo tcpdump -n -i eth2 icmp &
[1] 1409
$ tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-...
- 1,636
13
votes
Accepted
IPv6 and online privacy and security
Let's look at a live example. This being from my Linux workstation. (And for simplicity I actually omitted a couple of addresses.) I'll explain each of the addresses in turn:
$ ip a s dev br0
3: br0: &...
- 478
11
votes
Do I get any security benefits by NATing a network that's already behind a firewall?
No.
I agree with @RonMaupin in the comment: NAT is not a security feature but a workaround for the lack of IPv4 addresses.
NAT only add complexity without increasing security, if the network and the ...
- 19.4k
10
votes
Accepted
What's the difference between RADIUS and 802.1X Port-Based Authentication?
That's a lot of questions, so let's take them one by one.
What exactly is 802.1X Port-Based Authentication?
From Wikipedia :
IEEE 802.1X is an IEEE Standard for port-based Network Access Control
...
- 2,638
9
votes
Accepted
Locked myself out of my Cisco switch
If you didn't save the configuration, you could just restart the switch, but you will need physical access to the switch. You may be able to get someone at the site to restart the switch for you. ...
- 98.3k
9
votes
Mitigating 802.1x bypass by transparent bridging
Frankly, no.
802.1X authenticates the port and as long as it is authenticated it participates in the network. Inserted or even modified frames by an otherwise transparent network device cannot be ...
- 81.5k
8
votes
Accepted
Why my computer is making this ARP requests to external (Gov) IP addresses?
169.254.0.0/16 is reserved for link-local addresses as per RFC 3927. Link-local address space is used when there is no authority for IP address control (DHCP or static configuration). Some device with ...
- 81.5k
8
votes
Accepted
whois 243.25.203.20
As @tripleee said in his comment, looks like it is an IP from a reserved block, so it should not be public routable on the Internet (in an ideal world, that is :D).
You can check by specifying an ...
- 381
8
votes
Accepted
Why can't I get a WiFi password by sending out the same SSID?
Assuming you are talking about a PSK wireless network, then you misunderstand what is actually taking place.
The PSK isn't sent from a client to the AP. Rather it is a common starting point from ...
- 27.2k
7
votes
How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?
Use a VPN internally and treat the section of the network outside secure areas the same way you would treat the internet.
7
votes
Accepted
How do we prevent loss of sensitive information from MAC spoofing?
MAC spoofing is more about LAN disruption than stealing information.
I think you have a mistaken idea about routers. Routers do not route to MAC addresses, and on a LAN, a router is simply another ...
- 98.3k
7
votes
Accepted
What is the difference between "Message Digest" and Checksum?
A checksum is the general term used. A checksum can range from a check digit (parity bit) to a complex output string. Different checksums (examples below) can be chosen depending on the application.
...
- 316
7
votes
Accepted
Run MACsec and VLAN in parallel?
Welcome to Network Engineering! There is no standard for MACSec and 802.1Q, so manufacturers have come up with their own solutions. Cisco calls it "WAN MACSec," and does it this way:
The WAN ...
- 66.9k
7
votes
Accepted
Lost Ethertype in encrypted MACsec frames
MACsec actually adds to the ethernet frame header and trailer. You end up with a different value in the Ether Type field position, much like you do with 802.1Q, but the original Ether Type field is ...
- 98.3k
7
votes
Accepted
Is this computer a threat? On same network range, but in a workgroup
The situation you describe is very similar to what cost Target* many millions of dollars when its network was hacked, and customer information was stolen. Never let another company have something ...
- 98.3k
6
votes
Must a broadcast request come from the same network?
Broadcasts do not normally cross layer-3 (routers). Some routers can be configured to forward subnet broadcasts, but the limited broadcast (255.255.255.255) will not cross layer-3. The Cisco version ...
- 98.3k
6
votes
How to verify that a UDP port is open?
"nc -uvz ip port" isn't somehow accurate, you probably should use "nmap -sU -p port ip", if the result shows "open" then the udp port probably is open, if it shows "open|filtered" then probably it is ...
6
votes
Accepted
IPv6 built-in security?
To be honest, it's a bit of a botched job. People (including Big Name Vendors) still look at IPSec as a means of tunneling. In IPv6, the IPSec headers were meant to allow any socket from any ...
- 31.5k
6
votes
How can we identify layer two device in a network or what are those device effects on a frame
Traceroute is a Layer3 technology, aka. by it's very design it'll never show anything else than the routers in path to the specific host. Traceroute works by sending packets with decreasing TTL, thus ...
- 2,249
6
votes
Accepted
Use of /30 instead of /31
There is no particular security advantage. RFC3021 cites addressing efficiency as the motivation for implementing /31's
- 66.9k
6
votes
Accepted
What is the characteristic of spoofed ARP packets?
If you look at the packet, there is absolutely no difference in the format of a spoofed ARP reply and a real ARP reply: they look identical.
What makes a real ARP reply real? It came from the ...
- 16.1k
6
votes
Accepted
Does MACsec (IEEE 802.1AE) support multicast / broadcast?
MACsec provides security on the point-to-point link level. MACsec and 802.1X sit (more or less) in between the physical layer (L1) and the data link layer (L2). The key management is between the layer-...
- 81.5k
6
votes
Accepted
What is the purpose of native VLAN on a trunk link?
The default VLAN and the native VLAN are really two different concepts that are often mixed up because they are often the same VLAN, but they may not need to be.
VLAN 1 is the default VLAN (meaning ...
- 98.3k
5
votes
Accepted
Splitting a switch with VLANS. Is it secure?
When a tagged frame (it's Layer 2 we are talking about so we are dealing with frames, not packets) enter the switch, it will be verified against the authorized VLANs for the port.
If the VLAN2 is not ...
- 19.4k
5
votes
Accepted
How does a Cisco ACL handle fragments
You are not denying fragments. Cisco has an Access Control Lists and IP Fragments document that specifically deals with this problem.
ACLs and Fragmented Packets
ACLs have a fragments keyword ...
- 98.3k
5
votes
Single Mode Fiber Optic Connectors
There is nothing special about media converters in regard to single-mode fiber. A media converter would typically be used to extend the reach of copper (using fiber in between the media converters) ...
- 1,286
5
votes
Accepted
VLANS vs. subnets for network security and segmentation
Subnets are the IP stacks way of determining what hosts are "assumed to be on link". If an address is in the same subnet traffic will be sent directly, otherwise it will be sent to a router (by ...
- 13k
Only top scored, non community-wiki answers of a minimum length are eligible