Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

Our network administrators forbid the usage of private routers in our college. They bought new Cisco equipment (routers, switches) which detect routers and automatically ban them (it disconnects the room from switch port).

I'm a bit in touch with them and they said it does not work if the student plugs in switch first and routers after that (topology port->switch->router->pc). With this information I'm assuming these Cisco devices do not detect routers based on TTL as I originally thought. These administrators does not know how it works either, when I asked them how it detects they answered "It's Cisco"...

share|improve this question
Is the ban immediate, or take some time? Does it auto-revert once you remove the router? – lew Jul 11 '11 at 0:37

1 Answer

up vote 2 down vote

It depends on what routing technology that you use.

I know cisco switches have a optional security setting on allowing only a few MAC addresses associated with a port. See port-security.

This makes it impossible to set up a bridge between your network and your colleague's network, as the bridge will proxy the arp packets between the two networks, hence making the switch block the port.

A gateway router between two networks will not work either, because they will have to manually add your gateway/network in their router's routing table.

But, a NAT gateway should work, but along with the limitations a NAT router have. The colleague's network will not be able determine if your machine is acting as a gateway for your subnet or is acting as a single machine. (Unless cisco have implemented some crazy fingerprinting to determine inconsistency between the TCP/IP stacks used for various connections).

So, with these three possibilities, I suspect it is the port security which is banning routers from connecting to your network.

share|improve this answer
of course it detects nat, thats whole point why am i asking – gadelat Jul 10 '11 at 13:35
interesting, I've not seen any products capable of detecting and blocking NAT-routers. Do you know what kind of cisco equipment they have acquired? – Dog eat cat world Jul 10 '11 at 13:42
1  
Nope, but you can read more about possible ways in magazine hakin9 3/2005 . But it's 6 years old and not supposed for integration in routers, i was curious how cisco devices do that. – gadelat Jul 10 '11 at 13:56
If you find out what equipment the use, I'm sure you will find the options described in some manuals. – Dog eat cat world Jul 10 '11 at 14:08
Very nice article, but it all seems like a cat and mouse game. I wonder how the cisco equipment will react to a client running virtual PC's with the host machine running as a NAT router. – Dog eat cat world Jul 10 '11 at 14:19
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.