Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

2
votes
1answer
586 views

What are the best Nmap Scripting Engine (NSE) service discovery scripts? [closed]

Using nmap -sV can be quite verbose can -sU can take a very long time especially with -p 0-65535. To narrow your results and enumerate interesting services the wealth of NSE scripts can be very ...
-1
votes
1answer
270 views

How to Transfer packets from one ethernet card to another [closed]

I have a desktop with two ethernet(etho,eth1) cards and OSSIM installed in it. I have a laptop with webmin installed, where i want to write rules for transferring packets from eth1 to eth0. Both the ...
0
votes
1answer
176 views

Windows Firewall accepts a three-second unicast response from any source

I have read this article but still has some doubts may be after that... The Windows Firewall feature in Microsoft Windows XP Service Pack 2 (SP 2) accepts a three-second unicast response from ...
9
votes
3answers
7k views

How can I detect if someone is sniffing network packets on the LAN?

I would like to know if there is a product or software that can detect if there is a sniffer currently on the network? In other words is it possible at all to detect if there is a network card on ...
0
votes
2answers
159 views

Setting up a remote test environment correctly

My setup: - Main Box (connected to network) - VM1 : Linux - VM2 : Windows 7 Both the VMs are running off VM Player and using Bridged: connected directly to the physical network and replicating ...
9
votes
3answers
569 views

Would publishing a network diagram make the network less secure?

I have found some social networking sites that focus on sharing architecture (network maps and diagrams) and configuration. Does sharing this type of information decrease the security of my network? ...
-3
votes
3answers
190 views

wireless security concern [closed]

My small office has Netgear Router (N300 DGN2200). I had it secured using "password" . So any computer which needed access had to give the security password. But today a outsider accessed my router ...
2
votes
4answers
488 views

Detecting and filtering data over AC power lines?

Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication? I'm not sure how difficult this is ...
2
votes
1answer
82 views

Seeing outboud connections to random domains, how do I isolate the app responsible?

Last night I loaded up Fiddler2 to do a little debugging and I saw three connections to domains like hghefhhig How can I go about isolating the application responsible? I was thinking possibly ...
0
votes
2answers
109 views

Display all packets but not these TCP packets? [closed]

I'm trying to filter packets with wireshark, I would like to display all packets but terminal service communications, but if I do: tcp.dstport != 3389 && tcp.srcport != 3389 It would ...
6
votes
6answers
6k views

How to detect eavesdropping by your ISP

I've noticed some funny behavior lately with my home Internet connection such as connections dropping frequently, rate limiting occuring, and packet loss. I know how to get around this online, use a ...
7
votes
2answers
230 views

How serious is a local virus in terms of network security

My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the tech department, and they simply told him ...
2
votes
1answer
200 views

What security risks are involved with sending data over the internal network on Rackspace Cloud servers?

What are the risks involved with sending unencrypted data over the internal network with Rackspace Cloud Servers? Assume the interfaces use iptables to filter IPs and ports so they only accept data ...
9
votes
1answer
16k views

TCP Peer unexpectedly shrunk window messages in dmesg log

We get quite few messages like these in our dmesg log on various servers: TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: ...
32
votes
9answers
23k views

Why block outgoing network traffic with a firewall?

In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
-1
votes
2answers
160 views

How much chance does an attacker have in this situation?

nmap -p- IPADDRESSHERE shows no opened ports for a router from public interface (router is an openwrt machine). It drops all ICMP and only has IPv4 address (the only thing that it runs on public ...
3
votes
1answer
814 views

Identifying device based on the MAC address

Suppose we know that MAC address A belongs to a certain device (say an iPhone 5), and MAC address B also belongs to an iPhone 5. If we have a MAC address C which is in between A and B, does this ...
1
vote
3answers
1k views

What reputable site should I download Putty from?

I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code. If you needed to download Putty for a high security Windows ...
1
vote
1answer
450 views

How to write Snort rules based on MAC address?

I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some ...
2
votes
3answers
226 views

Passwords In Securing Network Devices

I don't do anything with corporate IT and networking, but I know enough to handle and get networks going. Anyway, something I ran into in my travels when it comes to the occasions of working on ...
1
vote
2answers
1k views

How to check if a port can be accessed from the outside

I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine. Is that possible at ...
2
votes
3answers
2k views

DDoS on LAN: How to Defend?

DDos on a wired network has to be extremely rare, since the intruder has to be physically connected to the network. However, let's say that it still managed to happen. How would you be able to defend ...
2
votes
2answers
360 views

Attacks surrounding /etc/hosts/

Although /etc/hosts/ is a file that comes up a lot in security, I am surprised to find there is no discussion here on this forum that describes how this can be used for an attack. Thinking about it, ...
3
votes
2answers
362 views

Which ports are potential security risks for nmap?

I'm using nmap and I am having trouble finding which ports are dangerous and pose the greatest security risks. Which ports are potential security risks for nmap? I was thinking samba, telnet, vnc ...
4
votes
1answer
348 views

Accurately mapping networks for purposes of pentesting

I always love staring at those network topology diagrams you see posted up in schools and online. Obviously if you physically setup and configured everything, plotting out servers, subnets, routers ...
8
votes
1answer
216 views

Are multiple network interface still recommended in a virtualized world?

Before the virtualization era, it was recommended to have several network card on a physical server : 1 for production dedicated network (only application's stream like http, SQL*NET, ...) 1 for ...
2
votes
1answer
7k views

How does pfsense block torrent traffic?

I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...
2
votes
3answers
422 views

Repudiation in Copyright Infringement (BitTorrent)

Seeing this question : How can alleged illegal downloading be detected? sparked a question I have had for a long time. How does repudiation/non-repudiation work in such cases ? Argument: It is known ...
1
vote
3answers
850 views

How can alleged illegal downloading be detected?

Joel Tenenbaum was accused of illegally downloading 30 songs. How might his action have been detected? Can anyone show a concrete method? Update Using a honey pot or monitoring the peers list makes ...
13
votes
3answers
2k views

Is a predictable MAC address a risk?

If you knew from the public internet that a certain IP address belonged to a machine with a certain MAC address, can you see any security exposure associated with that? I know that some software will ...
6
votes
1answer
180 views

Parabolic Denial Of Service — Would it work?

Would this DoS attack be effective: Attacker determines target (10.0.0.1) Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1 Servers reply to 10.0.0.1 with syn packets ...
1
vote
3answers
905 views

using network switches to prevent malicious promiscuous mode usage

I was reading the wiki about promiscuous mode when I came across a piece of information here that suggests that one could use network switches to prevent malicious use of promiscuous mode. In the ...
9
votes
2answers
519 views

How does the Copyright Alert System work? Who has implemented it?

Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright. I'm concerned how this oversight relates to my private traffic, and what laws ...
6
votes
2answers
550 views

What risks does WPA carry?

A family member of mine would like to be able to play old PSP games online. Unfortunately the device does not support WPA2, and my network is strictly WPA2 AES secured. What are the risks involved in ...
2
votes
1answer
605 views

Password authentication using DynamoDB

I'm working on a Mac app. I have users stored using DynamoDB. Authentication is needed to enforce access control on system-internal operations, such as uploading files to Amazon S3. Of course, I ...
5
votes
2answers
1k views

How can I use nmap to distinguish between a normal linux machine and an android device?

According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
44
votes
2answers
24k views

Is it a bad idea for a firewall to block ICMP?

This question was inspired by this answer which states in part: The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP). ...
2
votes
2answers
350 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
3
votes
8answers
30k views

How to block some websites in a small office?

I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites. My current connection is ...
3
votes
1answer
394 views

SSL VPN placement strategies

I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations: with firewall within the internal network within the DMZ Any reference also ...
3
votes
3answers
459 views

Privacy issues in Peer to Peer networks

In any typical P2P file sharing app, say DC++, the typical operations are search content, push content and pull content. A peer node broadcasts/multicasts its query to fellow peers and receives ...
1
vote
1answer
2k views

By default, does a linksys router log connections?

Routers have many settings that allow it to be safe and secure for the users that are connected to that network. A lot of these settings have to be manually configured though, which includes ...
3
votes
2answers
539 views

Dirty and clean interface on DMZ gateways

We have a webservice border gateway in DMZ which handles incoming and outgoing webservice requests in terms of authentication and security. We have two network interfaces in place, on is called ...
6
votes
3answers
659 views

Does NAT break source port randomization?

The standard defense against the Kaminsky attack is to use source port randomization for all DNS requests. Does NAT break the security benefits of source port randomization? In more detail, consider ...
-1
votes
2answers
411 views

Precautions to be made while using Internet chat to prevent being hacked? [closed]

I have read many websites which state that, "We can hack into computers while chatting on the internet." What are the best precautions to be taken while chatting to prevent unauthorized access? I ...
2
votes
1answer
366 views

Best way to validate /etc/hosts from third party providers to avoid ads?

A lot of people use a huge /etc/hosts file to simply redirect ads and scam sites to 127.0.0.1. The interesting part about this approach is that you can have the same hosts on your tablet, your android ...
2
votes
2answers
1k views

DMZ and LAN data exchange - what direction should connections be made?

When configuring services in the DMZ to exchange data with the internal LAN which scenario would be more secure: DMZ service pushes data to LAN service or LAN service pulls data from DMZ ...
4
votes
3answers
4k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
0
votes
1answer
263 views

adsl modem with the most security features [closed]

I am looking for the adsl modem with the most security features available. A 'least likely to be compromised', can be configured to be hack proof adsl modem with an internal firewall and other ...
1
vote
2answers
173 views

IP attack by reading/writing data?

If I remember correctly there is an ICMP attack whereby you can embed malicious code and it gets read/executed, causing the problem (similar to SQL injection). Are there any further/more dangerous ...