Skip to main content
Share Your Experience: Take the 2024 Developer Survey
16 votes
Accepted

Why should the native VLAN never be used?

You can and most likely will need to use a native VLAN on your trunk ports, at least on Cisco switches, other vendors do it differently. But what you have to remember that the security risk is more to ...
SleepyMan's user avatar
  • 2,016
13 votes
Accepted

IPv6 and online privacy and security

Let's look at a live example. This being from my Linux workstation. (And for simplicity I actually omitted a couple of addresses.) I'll explain each of the addresses in turn: $ ip a s dev br0 3: br0: &...
Michael Hampton's user avatar
11 votes
Accepted

What's the difference between RADIUS and 802.1X Port-Based Authentication?

That's a lot of questions, so let's take them one by one. What exactly is 802.1X Port-Based Authentication? From Wikipedia : IEEE 802.1X is an IEEE Standard for port-based Network Access Control ...
hertitu's user avatar
  • 2,658
11 votes

Do I get any security benefits by NATing a network that's already behind a firewall?

No. I agree with @RonMaupin in the comment: NAT is not a security feature but a workaround for the lack of IPv4 addresses. NAT only add complexity without increasing security, if the network and the ...
JFL's user avatar
  • 19.7k
9 votes
Accepted

Locked myself out of my Cisco switch

If you didn't save the configuration, you could just restart the switch, but you will need physical access to the switch. You may be able to get someone at the site to restart the switch for you. ...
Ron Maupin's user avatar
  • 99.8k
9 votes

Mitigating 802.1x bypass by transparent bridging

Frankly, no. 802.1X authenticates the port and as long as it is authenticated it participates in the network. Inserted or even modified frames by an otherwise transparent network device cannot be ...
Zac67's user avatar
  • 84.8k
8 votes
Accepted

Why my computer is making this ARP requests to external (Gov) IP addresses?

169.254.0.0/16 is reserved for link-local addresses as per RFC 3927. Link-local address space is used when there is no authority for IP address control (DHCP or static configuration). Some device with ...
Zac67's user avatar
  • 84.8k
8 votes
Accepted

whois 243.25.203.20

As @tripleee said in his comment, looks like it is an IP from a reserved block, so it should not be public routable on the Internet (in an ideal world, that is :D). You can check by specifying an ...
Daniele Santi's user avatar
8 votes
Accepted

Why can't I get a WiFi password by sending out the same SSID?

Assuming you are talking about a PSK wireless network, then you misunderstand what is actually taking place. The PSK isn't sent from a client to the AP. Rather it is a common starting point from ...
YLearn's user avatar
  • 27.4k
7 votes
Accepted

What is the difference between "Message Digest" and Checksum?

A checksum is the general term used. A checksum can range from a check digit (parity bit) to a complex output string. Different checksums (examples below) can be chosen depending on the application. ...
Tom's user avatar
  • 316
7 votes
Accepted

Run MACsec and VLAN in parallel?

Welcome to Network Engineering! There is no standard for MACSec and 802.1Q, so manufacturers have come up with their own solutions. Cisco calls it "WAN MACSec," and does it this way: The WAN ...
Ron Trunk's user avatar
  • 67.6k
7 votes
Accepted

Lost Ethertype in encrypted MACsec frames

MACsec actually adds to the ethernet frame header and trailer. You end up with a different value in the Ether Type field position, much like you do with 802.1Q, but the original Ether Type field is ...
Ron Maupin's user avatar
  • 99.8k
7 votes
Accepted

Is this computer a threat? On same network range, but in a workgroup

The situation you describe is very similar to what cost Target* many millions of dollars when its network was hacked, and customer information was stolen. Never let another company have something ...
Ron Maupin's user avatar
  • 99.8k
6 votes

How to verify that a UDP port is open?

"nc -uvz ip port" isn't somehow accurate, you probably should use "nmap -sU -p port ip", if the result shows "open" then the udp port probably is open, if it shows "open|filtered" then probably it is ...
Jailman Tough's user avatar
6 votes

How can we identify layer two device in a network or what are those device effects on a frame

Traceroute is a Layer3 technology, aka. by it's very design it'll never show anything else than the routers in path to the specific host. Traceroute works by sending packets with decreasing TTL, thus ...
Stuggi's user avatar
  • 2,269
6 votes
Accepted

Use of /30 instead of /31

There is no particular security advantage. RFC3021 cites addressing efficiency as the motivation for implementing /31's
Ron Trunk's user avatar
  • 67.6k
6 votes
Accepted

What is the characteristic of spoofed ARP packets?

If you look at the packet, there is absolutely no difference in the format of a spoofed ARP reply and a real ARP reply: they look identical. What makes a real ARP reply real? It came from the ...
jonathanjo's user avatar
  • 16.3k
6 votes
Accepted

Does MACsec (IEEE 802.1AE) support multicast / broadcast?

MACsec provides security on the point-to-point link level. MACsec and 802.1X sit (more or less) in between the physical layer (L1) and the data link layer (L2). The key management is between the layer-...
Zac67's user avatar
  • 84.8k
6 votes
Accepted

What is the purpose of native VLAN on a trunk link?

The default VLAN and the native VLAN are really two different concepts that are often mixed up because they are often the same VLAN, but they may not need to be. VLAN 1 is the default VLAN (meaning ...
Ron Maupin's user avatar
  • 99.8k
5 votes
Accepted

Splitting a switch with VLANS. Is it secure?

When a tagged frame (it's Layer 2 we are talking about so we are dealing with frames, not packets) enter the switch, it will be verified against the authorized VLANs for the port. If the VLAN2 is not ...
JFL's user avatar
  • 19.7k
5 votes
Accepted

How does a Cisco ACL handle fragments

You are not denying fragments. Cisco has an Access Control Lists and IP Fragments document that specifically deals with this problem. ACLs and Fragmented Packets ACLs have a fragments keyword ...
Ron Maupin's user avatar
  • 99.8k
5 votes

Single Mode Fiber Optic Connectors

There is nothing special about media converters in regard to single-mode fiber. A media converter would typically be used to extend the reach of copper (using fiber in between the media converters) ...
netdad's user avatar
  • 1,286
5 votes
Accepted

VLANS vs. subnets for network security and segmentation

Subnets are the IP stacks way of determining what hosts are "assumed to be on link". If an address is in the same subnet traffic will be sent directly, otherwise it will be sent to a router (by ...
Peter Green's user avatar
  • 13.3k
5 votes

Mitigating 802.1x bypass by transparent bridging

Welcome to Network Engineering! You might want to ask this on Information Security SE, but here are a few thoughts: If one has physical access to the network, an attacker can do lots of things. ...
Ron Trunk's user avatar
  • 67.6k
5 votes
Accepted

Use of VLAN allowed feature and security risk associated with not configuring it

Generally, you'll want to secure VLAN membership for all ports that you don't control on both link ends. If a trunk port - or rather the link partner - can simply join any VLAN they want then an ...
Zac67's user avatar
  • 84.8k
5 votes
Accepted

why do we use a layer 2 switch in a DMZ rather than a layer 3?

A layer-3 switch is primarily a layer-2 switch, but with a routing module in it. A layer-3 switch that is not configured with multiple networks is simply a layer-2 switch. Routers, including the ...
Ron Maupin's user avatar
  • 99.8k
5 votes

why do we use a layer 2 switch in a DMZ rather than a layer 3?

A DMZ is a security construct. That's where one places machines that are inherently untrustworthy -- eg. an internet accessible web site that someone, at some point, is going to break into. As such, ...
Ricky's user avatar
  • 32.2k
5 votes
Accepted

Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway

The comparison as given makes the two solutions seem very similar. Most Zero Trust Network Access implementations do implement the mentioned features but tend to add additional features and components ...
FrameHowitzer's user avatar
4 votes

cisco ACL no counter

(This came up on DSLR recently.) It has to do with the way traffic is processed. Since the first fragment carries the full layer-4 information, it is not handled as a fragment. So, it will match rule ...
Ricky's user avatar
  • 32.2k
4 votes
Accepted

Are there any security advantages to activating VLAN tagging?

The security part comes from using VLANs. Users and devices on one VLAN cannot communicate with users and devices on another VLAN, except through a router. This gives you the opportunity to place ...
Ron Maupin's user avatar
  • 99.8k

Only top scored, non community-wiki answers of a minimum length are eligible