Slashdot Mirror
What's On Your Network?
An anonymous reader writes "According to a Whitedust article you may currently have more on your network than you think you do. The article claims that not much security attention is generally given to one of the most elusive aspects of computer security; that of physical connectivity." From the article: "Broadcast traffic is on the rise, with more suspicious user activity in the logs every day. Then one morning you get a call from your irate boss wanting to know why he no longer has a network connection, yet the employees - or students or whoever - down the hall are able to play games and visit porn sites, at blazing speeds no less."
Great article!!!
I know of many (perhaps most) large corperations have incorporated strong policies regarding what an employee can plug into a network. Does this help the problem with unwanted 'network use' or do the policies get ignored?
It could be worse, it could be Monday.
Lots of network noise from my Apple boxen. AFP, Rendezvous, Netbios etc. Oh and stupid Linksys router querying my ISP's domain name servers to find out where 198.162.1.104 is and dumb shite like that, strange bittorrent stuff from the internet that for some reason gets bounced around my entire network.
Now can someone please tell me why tcpdump and tcpflow -c don't do the same thing. tcpflow seems to grab the entire data sans headers but missees most all of the lower level traffic (e.g ARP whohas etc), whilst tcpdump only grabs the headers no matter how big I make the snarfen -s thing or if I do -vv still only grabs the headers. It's like they both see different things.
Thanks for any help
but isn't this the sort of stuff that ANY network admin worth their salt should be completely aware of? If they need to be told this stuff they are not (IMHO) worth employing as other than apprentice network engineers. Or is this level of admin common in Windows environments?
the best solution I have seen is where you have to register your equipments MAC address, then you get a "static" (i.e. always the same) ip address served to you via dhcp. No registered MAC address == no ip address. Presumably they had something looking for unregistered MAC addresses too. Pretty good, but doesn't stop you going in with a static address in the right range tho...
$ strings FTP.EXE | grep Copyright
@(#) Copyright (c) 1983 The Regents of the University of California.
This article raises the issue of internal network security, which is something that's been increasing in profile as a security risk over the past few years as ethernet/wifi enabled devices get smaller, cheaper and easier to hide. However, this article's specific Cisco approach to dealing with things by tracking them back through routers and cisco-specific tools seems to be of less use than more general scanning and identification measures.
It's safe to say a good proportion of administrators already on networks with devices migrating on and off at will already have a consideration for these problems, and the specific approach detailed in the article may not be of best use to those less experienced admins starting to tackle this issue on their networks.
Business Voyeur
if you don't run DHCP, a fun project is to throw a DHCP server out there and see who gets configured.
It's amazing all the little devices that show up. Switches, old print servers, workstations tucked away in a corner somewhere that time forgot....now that many of these networks are starting to push 10 years, it's like archeology.
Every now and then you find something that you just can't physically find. Lotsa fun.
Each box that is supposed to be on the network has its MAC set to a fixed address.
Then a special range is set up that isn't able to access crap that is assigned to all new devices that aren't in the dhcpd.conf.
Any problems with that?
My mom says I'm cool.
Are there really companies out there that still don't have a policy about not hooking up private equipment to the LAN without permission? Are there even any that let you run your own server on their LAN without aking? I find that hard to believe. Even if bandwidth isn't an issue, the company owns the equiptment and has a right to say how it gets used, and what traffic is premitted. Anybody adding private equipment or running an unauthorized server has to know they're violating company policy, and can expect to be fired when it's discovered. The best way to keep it from happening a second time is to make sure everybody knows just why the fsckwit got canned.
Good, inexpensive web hosting
I distribute IP's thru DHCP, and I maintain an ACL via IPTABLES on my Linux router. DHCP distributes IP's based on MAC accress, and I do allow unknown MAC's to get an IP.
The trick is, that any IP that I did not setup in DHCP, is blocked via the ACL to all Internet Access.
Invariably, I get some VP/EXEC/VIP, call me and ask why his visiting sales rep cannot access his email. I walk into the office and the fellow has jacked into my network.
My reply is Sorry.. You can use our WLAN for internet access. No jacking into the network.
The WLAN is connected outside the firewall, so whatever they do there is of no concern to me.
Yes, there are flaws in this method, but so far, it has brought every unathorized network connection to my attention...
If static IP's were used wouldn't it make 99% of the problem go away? the remaining 1% being the guy who dutifully copies his IP on his workstation so he can plug something else into the network using his workstation IP. Like Xboxes or internet enabled coffee makers.
"Whats" on my network? I may have a What or two on my network, yes ...
I think I've heard it called 'treasure hunting' before. Especially at places with huge IT departments in the building that just can't seem to find somethings that are taking a few IPs. Usually it ends up being a laptop in someone's bag hitting the internet, or a WAP in an abandoned office is serving warez to someone in the building next door.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
Unplug unused network points.
Three months ago we had a security audit carried out by an external company. The first thing they did was find a couple of unused offices and plug their laptops into the network points. I'm glad to say that there was no result.
If you want to take this further then use managed switches and assign each port in use to a specific MAC address. That way if a 'visitor' pulls the plug on one of your computers and plugs their machine there will still be a nil result.
Ed Almos
Budapest, Hungary
The more corrupt the state, the more numerous the laws. - Tacitus, 56-120 A.D.
Um, duh, what company network doesn't have egress filtering (bye bye IM, Quake, SSH) and content filtering (bye bye porn, TheOnion, etc) ?
Answer: the same dumbasses who have 'mysterious' network problemss. If you don't really control your network, well, then... you don't really control your network.
Mod the article: -1, Fucking Obvious
I want to delete my account but Slashdot doesn't allow it.
tail -f /var/lib/dhcp/dhcpd.leases
There are nice things that can be done such as auth tables on the firewall to make sure the clients run something like sshauth before they can access the intarweb [openbsd firewall that is, i don't know any alternatives].
Why UNIX?
Check out Packeteer or some other QOS company. Those devices can show you what is going over your network and block or limit the unwanted traffic while protecting the business oriented applications. You can also find out who is playing games and surfing all day
Apparently, kids drive around with laptops looking for open network closets. These fuckers plugged in a cat5e into my switch and started leeching bandwidth for all their friends. I've recommended that my neighbors start locking their doors and change keys often just in case. Also, if you notice any unexplained cat5 going out doors into the back yard, you should investigate.
If I have a completely wired network, the article describes exactly how to find the culprit. In a college context, I can find the bad guys without leaving my office. I can tell exactly where the offending connection is being made. With the security video, I can even watch the act as it occurs.
Given wireless access, on the other hand, your problems are much greater. Even if I know which wireless access point is being accessed, I can't tell which laptop is doing what. It could be someone in a washroom somewhere. Naturally, I'm not delighted with the idea of providing wireless access to the students.
People who don't know these things should not be running networks.
For many years, I have been running some simple scripts on a machine on the network that regularly reads out switch MAC tables using snmp. I also read router ARP tables this way.
The result can be read from a webserver. IP address, MAC address, swichport and hostname are all conveniently grouped on a line.
Knowing which switchport it is on, looking in the patch cabinet, I know on which wallsocket a suspicious device is, and a chart on the wall shows me in which room it is.
Of course the routers have access lists so invalid network addresses aren't routed, and the DHCP server checks if a hostname conforms to the company convention before assigning an address,
Plugging in your home laptop yields you an alarm, not an address.
Not everyone here works in the IT field, yaknow... maybe once upon a time that was more likely that most of the readers would know this stuff, but today, there's a lot more people reading slashdot who come from far more varied backgrounds. I'm not a network admin (I do other sorts of IT work as part of my job, but not as all of my job) and I found the article to be of interest.
i am a soviet space shuttle
Pretty good, but doesn't stop you going in with a static address in the right range tho...
How is this "pretty good" then? It would take someone with access to a network port 2 seconds to find out your subnet information and would take them another 2 seconds to skip DHCP completely and put an address in manually. Even worse, they could add your entire subnet to the list of IP addresses on the system and cause IP address collisions with every host on your network.
Before anyone implements this suggestion thinking it's going to add much to your security, realize it's a big pain in the ass for not a lot of benefit.
I'm a big tall mofo.
What do you do when he brings his virus-laden laptop into the office BEHIND your firewalls and plugs it in?
Utilize the network admin's 22 calibour pistol...
how wonderfully clandestine public PR industry operatations are nowdays:
For more information on CDP, visit http://cisco.com/en/US/tech/tk648/tk362/tk100/tec
Hmmmmmmmm... and the
Yam, yam, uga booga, yam, yam, yade, yade, uga booga, yam, yam, yade, yade
You see, it is like a network security guild. If you don't know everything about network security then you shouldn't be allowed to learn anything more about network security.
Clearly this is a very effective way to improve the security on the networks around the world... ah, pardon the pun, I mean the Job Security for our dear paid up members of the Network Security Guild.
Akvo.org - the open source for water and sanitation
'Whats On Your Network?' is a good question that should have been asked of the resnet techs at my university. Getting on the school network is automated for all computers with a browser, but other hardware-based network equipment must have its MAC registered manually. Needless to say, resnet doesnt actually enjoy it. One time, some moron plugged the ethernet cable from the wall into a LAN jack rather than the WAN. Kids' computers were sending DHCP requests out, receiving two responses, and dragging the entire network down. The complaint calls rained down upon tech support, and network techs had to go through dorm after dorm, checking every single room. And you thought DHCP made everything easier.
You apparently do not live in the U.S. You see, here we have these things called laws that are written and voted upon by hairless monkeys that are given offices by people that can't be bothered to read and vote on these "laws" themselves.
Some of these "laws" revolve around personal opinion and human emotions known as "feelings." They state that if you do something that hurts someone elses "feelings" you will go to jail and have to give them a lot of money.
This has caused a rash outbreak of people "sniping" or hiding out in bushes that sometimes decorate offices and awaiting an unsuspecting employee to briefly brush past a site holding pornographic material. Google.com is a good example. In this instant they leap from the previously hidden sniping bush and proclaim that the barest hint of an unclothed nipple has hurt their "feelings"
This results in a winning lawsuit in which the unknowing employee receives a new boyfriend at the same time that he is given to the sniper as a money slave for the rest of his life. Sometimes it even results in the closing of an entire company and results in a rise in unemployment which these people called "taxpayers" really have something against.
A couple of years ago something that looked almost like a nipple, but clearly wasn't, caused a major change in the entire U.S. broadcasting industry because of all the people whose "feelings" the wardrobe malfunction had caused to be hurt.
This has caused companies to be very careful about keeping anything that could possible hurt "feelings" out of their offices and off of their computers. Where I work, we usually just leave the computers turned off ....
"Genius may shine aloof and alone, like a star, but goodness is social, and it takes two men and God to make a Brother."
I'm pretty sure there are no Whats on my network.
The shareholder is always right.
Check out 802.1x. Most modern switching gear supports it and some of the newer stuff even allows you to do dynamic policy enforcement (ACL's, rate limiting, etc.) based on group membership. It's much more scaleable and flexible than MAC-based authentication.
c ryptographyetc/peap_0.mspx
This can be done for both wired and wireless networks, as described in this Microsoft article. http://www.microsoft.com/technet/security/topics/
Client support exists for Windows, Mac OS, and *nix. It can take a while to get setup, but it's worth it.
Whats a whats??
cripes, people. This is a two-part problem. One, the process issue, deals with how you manage physical port assignment. Two, the technical issue, deals with how you enforce the process. This is most easily done with some form of port security. Map the MAC to the physical port and lock it down. Then disable all the unused ports, and you're set.
gods, you'd think this was a difficult issue...
Great, now I have this mental image of munchkins singing "We represent the Networking Guild" ... ;)
i am a soviet space shuttle
..the BOFH excuse server. The random answer it gave me was singularly appropriate although unhelpfully honest:
your excuse: because of network lag due to too many people playing deathmatch
--- Hot Shot City is particularly good.
...wrong audience here. Most /. readers are operating home networks. Very few of them actually have real network related jobs. They might work help desk, or be in IT management. But real network jocks have very little to do with Slashdot.
-"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
I don't know if this was a mis-type, but you wrote:
"198.162.1.104"
That is a real-world public address. Your internal network should be using 192.168.1.104, not *198.162*
Just a thought, anyway
The luney right hates porn.
The luney left hates everything straight male.
Neather side has that much influence outside of primary season.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
As women (and many men) started to get sick of a workplace culture where guys would think it was funny to post the Hustler centerfold above the new girl's desk, we began to recognize that sexually-related conduct causes problems in the workplace. That's why telling dirty jokes, pornographic pranks etc are usually forbidden. As for surfing pr0n, that's just stupid, do that on your own time. I goof off at work as much as anyone but I know that adult material is for my "me time" at home.
This has caused a rash outbreak of people "sniping" or hiding out in bushes that sometimes decorate offices and awaiting an unsuspecting employee to briefly brush past a site holding pornographic material. Google.com is a good example. In this instant they leap from the previously hidden sniping bush and proclaim that the barest hint of an unclothed nipple has hurt their "feelings"
Now that's just paranoia, and smacks of thinly-veiled anti-feminist hysteria too.
That "wardrobe malfunction"... that was wildly overreacted-to. How is that different? Well, you have to go to work, but nobody's forcing you to watch the Superbowl. That incident might have warranted a "you guys are morons" letter from the FCC, but not a big fine.
Freedom: "I won't!"
Don't trust random devices on the network-- if you have a service you want secure, have some kind of authentication on it, don't just trust random connections.
Luke-Jr
Clinton did a lot to push it back to sanity. If he can get a blowjob from a subordinate and keep his job so can anybody. (What? Anybody else would be fired? Republican!)
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
The very first thing you do is make sure you have no live ports just 'laying around'. If you dont have a person at a desk, its jack gets unpatched. ( or turned off at the switch )
Secondly, you tie MAC addresses to specific ports on your switches, to help prevent people moving around without your knowledge. It also slows down people from causally swapping their company owned PC with a personal laptop. However, unlike the good old days, it wont slow down those damned wifi boxes since they can clone mac addresses easily.. But its at least a start.
---- Booth was a patriot ----
Seriously, please direct us to one single, solitary example of a company that was literally shut down because an employee was looking at a stiff nipple.
Honestly, so much of this liability paranoia is such crap it boggles the mind that people actually believe it. Sure, if someone is doing something illegal, the company may be questioned and asked for assistance by the authorities, but that's a far cry from "Sometimes it even results in the closing of an entire company and results in a rise in unemployment which these people called "taxpayers" really have something against."
Seriously, people using this sort of bullshit language are far more to blame for these absurd policies (be they factual or otherwise) than any real liability exposure.
I'm a student at UCONN. The admins in our shop use this piece of software called NetReg (orig. from Southwestern University [netreg.org]) to register all network enabled devices. Unregistered devices are thrown in a restricted 10.x.x.x subnet and forced to register before they are allowed to receive a dynamically assigned public IP address. To prevent network abuse via manually assigned static IP address, servers routinely scan the network for IP's not dynamically assigned and MAC address tied to public IP's that are not registered. In the event an unregistered device is discovered with a public IP, the admins shutdown the switchport and the student/faculty is forced to call our call center. This seems to prevent a lot of headaches.
let say that you have multiple subnets, 192.168.0.x/24, 192.168.1.x/24, until 192.168.255.x/24 where all the router ip is at the start such as 192.168.0.1 (being the default gateway of each.)
is there something that eats up all the ip address such as a computer being a member of all the subnets? i want to prevent people from doing a static ip address (as it will result in ip address conflict). so that thing will listen for dhcp requests and will release the ip and assign it to the requesting terminal instead. this will force everyone to use dhcp and we can keep track of all users and their mac address since they need to register or they will not be able to connect to the network.
so in the scenario, let say a computer will assign itself the ip address 192.168.0.2, 192.168.0.3,
so fellow slashdotters, do you have other suggestions for preventing people from logging to a network (with switches) without being able to assign a static ip? (of course mac address filtering will not work as they can still put any ip address and access the network.) the 802.1x may also help but it is mainly for the security of the physical port and not the logical network.
Live your life each day as if it was your last.