Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

6
votes
2answers
14k views

What is best practice for separation of trusted zones from a DMZ with a single firewall?

At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged ...
8
votes
3answers
13k views

How can I keep a roommate from seeing my web activity?

I have a roommate who is a network security engineer and I think he hacked our home network and now knows what sites I am visiting and what I am doing online. Although he is not stealing anything I ...
6
votes
7answers
2k views

What security risks exist in cell phone apps' data transfer?

Smartphones apps transfer various types of data over the provider's data network (or wifi, if enabled). What security risks are there in this transfer, and how can the risks be mitigated? I'm not ...
3
votes
5answers
2k views

Can teleworking let my boss to sniff my network traffic? What else could he do?

My boss proposed me to code from home on the their machines via internet, in two possible ways: I would connect to their computer and work on their machine, as if I was in front of the computer(from ...
9
votes
2answers
697 views

How to implement secure device identification in a for-pay wifi router to prevent usage fraud?

After reading this question about how for-pay wifi routers identify specific devices it got me thinking about what a secure alternative might be. I know that certain research has focused on ...
8
votes
4answers
719 views

CAM table attack in 2011?

Today's switches are vulnerable to CAM Table attack? https://secure.wikimedia.org/wikipedia/en/wiki/CAM_Table
5
votes
3answers
10k views

Resolving an IP address of a Remote machine to its MAC address

I wanted to know whether its possible to get the MAC address of remote node (computer/Access Point) if I know its IP address. I have heard that if someone sends you an email (even through gmail), you ...
1
vote
3answers
184 views

Can man-in-the-middle attacks affect anyone not connected to the attackers network?

I'm trying to understand what these attacks are restricted to. I'm aware that man-in-the-middle attacks can be done if the attacker is on the same network (using something like Wire Shark), but is it ...
29
votes
2answers
112k views

What is the real function and use of a DMZ on a network?

I read the article on Wikipedia describing what a DMZ (demilitarized zone) is on a network, but am still failing to grasp both how it is set up (ie: is it within the main network or sequestered away?) ...
17
votes
4answers
2k views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reach the ...
21
votes
12answers
47k views

Public DMZ network architecture

Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one: Now that I got employed, my boss, a ...
19
votes
5answers
3k views

To firewall or not to firewall?

There's recently been some discussion (to be generous) about the pros and cons of having a firewall deployed in front of servers. The con mainly being that it's a point of failure in case of a DDoS. ...
12
votes
2answers
14k views

Is it possible to use the aircrack-ng tool to crack a WPA2 Enterprise network?

is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks. If it can, how, but if not, is there another ...
25
votes
10answers
6k views

Can IP address be a component of 2-factor authentication?

I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
13
votes
3answers
22k views

How can I detect if someone is sniffing network packets on the LAN?

I would like to know if there is a product or software that can detect if there is a sniffer currently on the network? In other words is it possible at all to detect if there is a network card on ...
11
votes
5answers
3k views

Can voice chat be spied?

I wonder if voice chat (via public services like yahoo, google talk, skype, etc) is practically secure? Is it possible for the ISP or any middle point? I do not consider hacking the computers, but ...
50
votes
1answer
3k views

What's the risk if I accidently type my password into a username field (Windows logon)?

I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
10
votes
6answers
14k views

Automated tools for Cisco IOS config auditing? [closed]

Are there any automated tools for auditing config files exported from Cisco IOS devices? Free/Open Source is always nice, but anything that does the job would be of interest.
10
votes
2answers
2k views

Malware known to use port knocking to evade detection by network scanners?

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
7
votes
2answers
5k views

Need help identifying the OSX process that's generating strange network traffic

Since the past few days, I noticed that my router was a bit slow, and was restarting by itself at times. When looked at it's logs, they had entries like: Friday Jul 13 13:09:02 2012 1 Blocked by DoS ...
7
votes
2answers
7k views

Is it possible to speed up WPA/WPA2-PSK cracking using a rogue AP?

We know that WPA/WPA2-PSK uses a PTK (Pairwise Transient Key) for each client to encrypt the communication. This PTK is generated through the process known as 4-way handshake. As told in the related ...
11
votes
1answer
5k views

Is WPA2 WiFi protected against ARP poisoning and sniffing?

Is WPA2 WiFi protected against ARP poisoning? If not, can the ARP poisoner decrypt the packets?
11
votes
5answers
10k views

Can I block based on Mac Address?

Incase of dynamic IP's the hacker can work around by taking a new IP or use a Proxy, is it possible to make a ban based on Mac Address ? I want to block at the Webserver level so that unwanted users ...
6
votes
3answers
27k views

How to tell if you're being ARP poisoned?

I am having some issues at work and there is a new network admin in place. I think I am being monitored so decided to run ArpSpy X in two scenarios: Over WiFi bridge pluged into cisco router to took ...
3
votes
7answers
61k views

How to bypass restrictive mac address filtering on home network (not malicious)

Background A short sketch of my situation before I formulate my question: I am on a large home network, which is privately administered by a couple of admins. The network consists of a lan and a ...
1
vote
3answers
11k views

Is there any solution for block the HTTPS traffic using URL filtering?

The URL filtering can block the HTTP traffic but not the HTTPS traffic in Internet Explorer. For example, the website http://www.facebook.com is blocked by the URL filtering while the ...
13
votes
2answers
4k views

Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?

I have read the TCP Connection Establishment on Wikipedia In brief the packets to start are SYN, with a (hopefully) random sequence number A from the client. SYN-ACK, responding, with A+1 and ...
12
votes
4answers
2k views

Why don't ISPs filter on source address to prevent spoofing?

I'm under the impression that if all the ISPs were required to filter on the source IP address of all outbound packets, that spoofing would be reduced considerably. Are any ISPs implementing this ...
11
votes
1answer
2k views

Bypassing hidden SSID and MAC filtering “protection”

I was browsing over this question and had some follow up questions from a practical perspective. What tools will show the SSID of an AP with the SSID set to hidden or broadcasting disabled? I have ...
8
votes
3answers
861 views

Is IPv6 with NAT less secure than IPv4?

This is a follow up to a snippet from another answer. There, user Ninefingers writes: (...) only allow outbound connections, ever. Do this in spite of NAT as IPv6 will make those NAT defences ...
7
votes
2answers
3k views

Snort Sensor Placement

I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
7
votes
1answer
1k views

How to get hold of and use WPA session keys?

I'm testing sniffing and decrypting my WPA2 wifi network traffic. But when using airdecap to decrypt the capture file (created by airodump) using my WPA passphrase I only get broadcast traffic. If I ...
6
votes
3answers
2k views

Is it possible to catch a virus on my LAN without clicking on anything?

My unpatched PC running Windows is connected to a network which contains other "infected" computers, can I get infected by viruses without any interaction on my part?
4
votes
2answers
2k views

What is more secure: ISDN, Cable Modem, DSL, T1, etc…?

This discussion came after showing a friend this Security.SE post regarding DNS attacks, and after reading about a Cable Modem MITM attack. Given the current options available to consumers, what ...
3
votes
1answer
273 views

Securing my network: unmasking spoofed mac possible?

In Kali you can: airmon-ng start wlan0 ifconfig mon0 down macchanger -r mon0 (-r changes mac id to a random number) ifconfig mon0 up This attack for example: aireplay-ng -0 2 -a [ap mac #] -c ...
2
votes
1answer
182 views

Does having a VPN service mean accessing my email etc. over public free open WiFi mean I have security/privacy? [duplicate]

Is my information secure over public WiFi if I use a VPN service? i.e. protection of emails and login details.
1
vote
2answers
2k views

How to check if a port can be accessed from the outside

I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine. Is that possible at ...
0
votes
5answers
1k views

Monitor websites being visited on network

I need to monitor the websites being visited on my wifi network by the different IPs connected to the network. What is the best way to do this? I spent some time with Wireshark but I feel it is a bit ...
-2
votes
4answers
16k views

If a hacker is on the same Wifi Network as I am, what can he do? [duplicate]

Ok so when a hacker has the wifi network's password and gets on the network, he can do things like monitor traffic, catch passwords, even access PCs, etc. But what I'm interested of knowing is what ...
2
votes
1answer
70 views

Securely sending packets without them being spoofed

I'm working on a simple multiplayer game to break the ice with network programming. I have a system where if the player moves, the server receives a move packet that contains some stuff like the ...
2
votes
3answers
1k views

How can alleged illegal downloading be detected?

Joel Tenenbaum was accused of illegally downloading 30 songs. How might his action have been detected? Can anyone show a concrete method? Update Using a honey pot or monitoring the peers list makes ...
-1
votes
3answers
718 views

Can workplace wifi track ip address to an employee's computer? [duplicate]

At my work there is secure WiFi for all the employees. If someone has sent harrassment / sexual harrassment emails to me through the company WiFi, is there a way for my company to trace the IP address ...
23
votes
1answer
6k views

What are darknets, and how can they be used to provide security and anonymity in network communication?

One of the major problems with the internet is that it's difficult to stay anonymous while retaining the ability to communicate with a large number of people. While encryption can be done effectively ...
27
votes
4answers
4k views

How do you deal with massive port scans?

This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200. The IP address is 85.25.217.47 which seems ...
14
votes
3answers
2k views

VPS security best practice

I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it. I've previously been hosting it off a VM in the house, but I want to ...
6
votes
6answers
15k views

monitoring outgoing network traffic [closed]

The graphs for one server that I am using are showing consistent 7.5 kb/s outgoing network traffic that started a few days ago. How can I monitor/log/capture/analize this traffic to see what is it, ...
15
votes
3answers
5k views

Recommendations for honeypot software

A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction ...
30
votes
6answers
6k views

Can malware be dangerous even when quarantined?

I am reading a book on network security and when talking about user confusion it writes: "It is not uncommon for a user to be asked security questions such as Is it safe to quarantine this ...
18
votes
4answers
14k views

Can home routers get infected?

I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection? I used the search bar but ...
14
votes
2answers
10k views

How do Intrusion Detection Systems (IDS) work?

How do Intrusion Detection Systems (IDS) work? As I understand it, they monitor network traffic but what exactly do they look for? How can they tell apart regular activity from intrusions?