Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to know ways of detecting rogues laptops connected to ethernet sockets not properly secured in a big organization that has a plain network segment. I know that this can be prevented using some techniques like MAC filtering but suppose that in this company they don't use any of this prevention security measures.

One possible solution I can think is to use traceroute to identify the path and identify the last hope to the laptop. This can be used to identify the last router but...

Is it possible to use some layer-2 protocol or other techniques to identify where is a rogue laptop connected to an un protected ethernet socket in a big organization?

share|improve this question

2 Answers 2

up vote 7 down vote accepted

Any managed switch should be able to tell you which ports it has seen a given MAC address on. Identify the IP, ARP on that network, query switches on that segment for the given MAC address.

Prevention beats all, though: How can I restrict access to network data by an unauthorized computer that connects via Ethernet?

share|improve this answer
    
Keep in mind that this technical solution will only work if you know what is supposed to be on your network in the first place. For that you need a complete inventory of all approved devices and their MAC addresses. Then you look at the MAC address tables on the switches to find those not approved. –  GdD Mar 6 '13 at 9:06
    
This too is unpractical when organziation size goes to 26000 strong or more. You need a protocol or point solution approachi –  Saladin Mar 6 '13 at 15:30

The technical answer or solution is what you call Network Admission Control. Its does all the police work for you.

On the suspicious switch you can run command not exact but something similar to show mac table. Basically all the port and mac binding is store at CAM table aka content addressable memory e.g

    Cat6K#show mac-address-table int gi 6/11

If you are thinking of actively blocking using in house switches then go for DAI aka dynamic arp inspection basically it is a white list for all arp requests and denies authorized mac to ip binding.

As for knowledge you should know at osi layer 3 and layer 2 there isn't any inherent control to stop spoofing from happening. It what you call unsolicated arp.Thus you have to rely on point solution for this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.