Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

1
vote
1answer
332 views

Is suspicious network activity likely to be caused by a rootkit?

Netstat has been one of my favorite tools to check out possible malicious connections, but then I heard about the dangers of rootkits and their high complexity, allowing them to be able to bypass ...
19
votes
1answer
4k views

What are darknets, and how can they be used to provide security and anonymity in network communication?

One of the major problems with the internet is that it's difficult to stay anonymous while retaining the ability to communicate with a large number of people. While encryption can be done effectively ...
3
votes
5answers
1k views

Building my own Darkspace

I have searched through the internet about creating a darknet and there is a confusion. There are two definitions, the first one is network used for private p2p (like freenet) and another one that ...
2
votes
2answers
278 views

Analyzing Network Anomalies for Malicious events

For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies. Our main ...
0
votes
1answer
1k views

DrayTek Vigor 2920 HTTPS allowed

In my office we have a DrayTek Vigor 2920 router, with CSM setup to only allow certain keywords (keyword objects) to certain IP groups. This all works fine, however we've discovered that all HTTPS ...
10
votes
4answers
5k views

Security measures against packet sniffing

I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
5
votes
1answer
122 views

Symbiote Counter-Attack Detection

I saw this video on YouTube about hacking Cisco phones (and other embedded systems) and I was overjoyed when the presenter not only hacked, but presented a security solution. Intrigued, I started ...
3
votes
5answers
5k views

How to Investigate Wi-Fi Intrusion and where to look for evidence?

I'm trying to figure out how to configure a network so that I can tell what an intruder did (in the past) while on the network after they are detected. eg. If someone with a wi-fi enabled laptop ...
0
votes
1answer
2k views

How to track down an IP spoofer?

We just installed a SonicWALL NSA 3500 and I've noticed a few times per day there will be an alert entry like this: Time: 01/02/2013 9:00:41.000 Priority: Alert Category: Intrusion Prevention ...
3
votes
2answers
500 views

How was pentest performed in the era with no frameworks like Metasploit?

I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 ...
1
vote
6answers
414 views

Secure internet access while traveling

Given the risks of shared wi-fi as stated here, here and here, I would like to ask what are good practices for someone who is always traveling. While having your own wi-fi with a strong WPA2 password ...
2
votes
2answers
5k views

Block all internet access from a computer except for allowed applications and domains?

I want to block all internet access from a computer except for allowed applications and domains. E.g. BLOCK ALL Except security.stackexchange.com/... Except skype.exe How can I do this? -It needs to ...
2
votes
3answers
1k views

Identify a process that uploads data

I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about ...
0
votes
2answers
606 views

Networking books for programmers [closed]

I have some programming experience, mostly in web apps, based on pre-existing frameworks. That is, all the networking side of things are handled already, and no knowledge of them is necessary. I ...
0
votes
2answers
407 views

Network security: Public and Private keys

In Pretty Good Privacy, it is said that Sender sends compressed message and encrypts the message with the private key of himself. And then Receiver will decrypt that message with the public key of the ...
3
votes
1answer
325 views

Security of Openflow/SDN network

Openflow/SDN networks give a remote controller the ability to manage the behavior of network devices i.e. configurations. They can forward instruction sets to dynamically change network configuration. ...
-2
votes
1answer
68 views

Connecting to IP [closed]

It is possible to connect to multiple IPs at a time like when we are connected to LAN at the same time we can be connected to a Wireless connection. In this case does our network speed gets added or ...
2
votes
2answers
311 views

DNS cache poisoning

What are the things the attacker needs to know from the victim to perform DNS cache poisoning ? for example : IP , Port number and Transaction number what else ?
-1
votes
1answer
847 views

Designing DMZ(s) [closed]

I was wondering what would be the correct way to isolate servers in order to protect them and us from too much harm. Let's have two scenarios: 1) Access to Application Server from the world We have ...
3
votes
1answer
316 views

Are man-in-the-middle attacks against p2p systems realistic?

I'm implementing a DHT based on Kademlia following this paper. The protocol described in this paper uses nonces to protect against man-in-the-middle attacks. The disadvantage is that latency gets ...
14
votes
3answers
812 views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
0
votes
3answers
399 views

Some issues with iptables and nmap

When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default. However I can use HTTP or SSH, so that ...
2
votes
2answers
12k views

Router admin password was changed, how did this happen and how to prevent [closed]

Internet was extremely spotty for about a week. I was on/off cycling the cable model and router almost daily, before I tried to sign into my router (198.162.1.1). When I did I was presented with a ...
5
votes
2answers
1k views

Unidentified public network sending traffic through my computer

I'm having a problem with one of my computers. I suspect it's being used for something malicious. A few weeks ago my internet connection went down, I called my ISP and they told me that no MAC ...
1
vote
1answer
535 views

What are the best Nmap Scripting Engine (NSE) service discovery scripts? [closed]

Using nmap -sV can be quite verbose can -sU can take a very long time especially with -p 0-65535. To narrow your results and enumerate interesting services the wealth of NSE scripts can be very ...
-1
votes
1answer
259 views

How to Transfer packets from one ethernet card to another [closed]

I have a desktop with two ethernet(etho,eth1) cards and OSSIM installed in it. I have a laptop with webmin installed, where i want to write rules for transferring packets from eth1 to eth0. Both the ...
0
votes
1answer
173 views

Windows Firewall accepts a three-second unicast response from any source

I have read this article but still has some doubts may be after that... The Windows Firewall feature in Microsoft Windows XP Service Pack 2 (SP 2) accepts a three-second unicast response from ...
9
votes
3answers
7k views

How can I detect if someone is sniffing network packets on the LAN?

I would like to know if there is a product or software that can detect if there is a sniffer currently on the network? In other words is it possible at all to detect if there is a network card on ...
0
votes
2answers
154 views

Setting up a remote test environment correctly

My setup: - Main Box (connected to network) - VM1 : Linux - VM2 : Windows 7 Both the VMs are running off VM Player and using Bridged: connected directly to the physical network and replicating ...
9
votes
3answers
565 views

Would publishing a network diagram make the network less secure?

I have found some social networking sites that focus on sharing architecture (network maps and diagrams) and configuration. Does sharing this type of information decrease the security of my network? ...
-3
votes
3answers
189 views

wireless security concern [closed]

My small office has Netgear Router (N300 DGN2200). I had it secured using "password" . So any computer which needed access had to give the security password. But today a outsider accessed my router ...
2
votes
4answers
477 views

Detecting and filtering data over AC power lines?

Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication? I'm not sure how difficult this is ...
2
votes
1answer
80 views

Seeing outboud connections to random domains, how do I isolate the app responsible?

Last night I loaded up Fiddler2 to do a little debugging and I saw three connections to domains like hghefhhig How can I go about isolating the application responsible? I was thinking possibly ...
0
votes
2answers
107 views

Display all packets but not these TCP packets? [closed]

I'm trying to filter packets with wireshark, I would like to display all packets but terminal service communications, but if I do: tcp.dstport != 3389 && tcp.srcport != 3389 It would ...
6
votes
6answers
6k views

How to detect eavesdropping by your ISP

I've noticed some funny behavior lately with my home Internet connection such as connections dropping frequently, rate limiting occuring, and packet loss. I know how to get around this online, use a ...
7
votes
2answers
226 views

How serious is a local virus in terms of network security

My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the tech department, and they simply told him ...
2
votes
1answer
197 views

What security risks are involved with sending data over the internal network on Rackspace Cloud servers?

What are the risks involved with sending unencrypted data over the internal network with Rackspace Cloud Servers? Assume the interfaces use iptables to filter IPs and ports so they only accept data ...
9
votes
1answer
15k views

TCP Peer unexpectedly shrunk window messages in dmesg log

We get quite few messages like these in our dmesg log on various servers: TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: ...
32
votes
9answers
21k views

Why block outgoing network traffic with a firewall?

In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
-1
votes
2answers
157 views

How much chance does an attacker have in this situation?

nmap -p- IPADDRESSHERE shows no opened ports for a router from public interface (router is an openwrt machine). It drops all ICMP and only has IPv4 address (the only thing that it runs on public ...
3
votes
1answer
770 views

Identifying device based on the MAC address

Suppose we know that MAC address A belongs to a certain device (say an iPhone 5), and MAC address B also belongs to an iPhone 5. If we have a MAC address C which is in between A and B, does this ...
1
vote
3answers
1k views

What reputable site should I download Putty from?

I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code. If you needed to download Putty for a high security Windows ...
1
vote
1answer
431 views

How to write Snort rules based on MAC address?

I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some ...
2
votes
3answers
224 views

Passwords In Securing Network Devices

I don't do anything with corporate IT and networking, but I know enough to handle and get networks going. Anyway, something I ran into in my travels when it comes to the occasions of working on ...
1
vote
2answers
1k views

How to check if a port can be accessed from the outside

I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine. Is that possible at ...
2
votes
3answers
1k views

DDoS on LAN: How to Defend?

DDos on a wired network has to be extremely rare, since the intruder has to be physically connected to the network. However, let's say that it still managed to happen. How would you be able to defend ...
2
votes
2answers
331 views

Attacks surrounding /etc/hosts/

Although /etc/hosts/ is a file that comes up a lot in security, I am surprised to find there is no discussion here on this forum that describes how this can be used for an attack. Thinking about it, ...
3
votes
2answers
340 views

Which ports are potential security risks for nmap?

I'm using nmap and I am having trouble finding which ports are dangerous and pose the greatest security risks. Which ports are potential security risks for nmap? I was thinking samba, telnet, vnc ...
4
votes
1answer
337 views

Accurately mapping networks for purposes of pentesting

I always love staring at those network topology diagrams you see posted up in schools and online. Obviously if you physically setup and configured everything, plotting out servers, subnets, routers ...
8
votes
1answer
214 views

Are multiple network interface still recommended in a virtualized world?

Before the virtualization era, it was recommended to have several network card on a physical server : 1 for production dedicated network (only application's stream like http, SQL*NET, ...) 1 for ...