Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When pentesting a network, call it ExampleNet, the network range sometimes exceeds 256 hosts, such as the range x.y.56.0-x.y.63.255. Does this mean that a compromised host on x.y.56.z could be used to leverage a MITM attack against a range such as x.y.62.z, considering they both share the same ethernet?

share|improve this question
    
Not a security question, but a basic IP networking one. 256 hosts is not any kind of limit on network size; it's just a size that used to be popular 20-30 years ago. See en.wikipedia.org/wiki/Classful_network –  Graham Hill Apr 23 '12 at 10:59
add comment

1 Answer

up vote 1 down vote accepted

It generally depends on network setup. Some commercial switches can separate the network out into different subnets, with special routing tables between them. That way you'll have a single physical switch connecting all the machines, but you'll still have several subnets.

They may also be using technologies like ipsec to encrypt and authenticate network communications, which can make a MITM attack difficult, if not impossible.

But, if it's all on the same switch, the switch isn't doing anything "clever", and they're not using a protection technology such as ipsec, then you should be able to perform a MITM attack using a single comprimised host.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.