Network Security - securing network infrastructure and connections
2
votes
4answers
347 views
How to Investigate Wi-Fi Intrusion and where to look for evidence?
I'm trying to figure out how to configure a network so that I can tell what an intruder did (in the past) while on the network after they are detected.
eg. If someone with a wi-fi enabled laptop ...
0
votes
1answer
370 views
How to track down an IP spoofer?
We just installed a SonicWALL NSA 3500 and I've noticed a few times per day there will be an alert entry like this:
Time: 01/02/2013 9:00:41.000
Priority: Alert
Category: Intrusion Prevention
...
2
votes
2answers
267 views
How was pentest performed in the era with no frameworks like Metasploit?
I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 ...
1
vote
6answers
195 views
Secure internet access while traveling
Given the risks of shared wi-fi as stated here, here and here, I would like to ask what are good practices for someone who is always traveling.
While having your own wi-fi with a strong WPA2 password ...
0
votes
1answer
132 views
How do I use two different Public IP to add a new server to the DMZ? [closed]
My network looks something like this;
INTERNET»»ROUTER»»ASA FIREWALL»»»INTERNAL NETWORK
Right now, we are using a public IP in a range like for instance of 50.224.157.105, which we are using in the ...
0
votes
2answers
376 views
Block all internet access from a computer except for allowed applications and domains?
I want to block all internet access from a computer except for allowed applications and domains.
E.g.
BLOCK ALL
Except security.stackexchange.com/...
Except skype.exe
How can I do this?
-It needs to ...
2
votes
3answers
199 views
Identify a process that uploads data
I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about ...
0
votes
2answers
147 views
Networking books for programmers [closed]
I have some programming experience, mostly in web apps, based on pre-existing frameworks. That is, all the networking side of things are handled already, and no knowledge of them is necessary.
I ...
0
votes
2answers
140 views
Network security: Public and Private keys
In Pretty Good Privacy, it is said that Sender sends compressed message and encrypts the message with the private key of himself. And then Receiver will decrypt that message with the public key of the ...
3
votes
1answer
269 views
Security of Openflow/SDN network
Openflow/SDN networks give a remote controller the ability to manage the behavior of network devices i.e. configurations. They can forward instruction sets to dynamically change network configuration. ...
-2
votes
1answer
63 views
Connecting to IP [closed]
It is possible to connect to multiple IPs at a time like when we are connected to LAN at the same time we can be connected to a Wireless connection. In this case does our network speed gets added or ...
2
votes
2answers
218 views
DNS cache poisoning
What are the things the attacker needs to know from the victim to perform DNS cache poisoning ?
for example : IP , Port number and Transaction number
what else ?
-1
votes
1answer
342 views
Designing DMZ(s) [closed]
I was wondering what would be the correct way to isolate servers in order to protect them and us from too much harm.
Let's have two scenarios:
1) Access to Application Server from the world
We have
...
2
votes
1answer
166 views
Are man-in-the-middle attacks against p2p systems realistic?
I'm implementing a DHT based on Kademlia following this paper.
The protocol described in this paper uses nonces to protect against man-in-the-middle attacks. The disadvantage is that latency gets ...
-1
votes
1answer
108 views
Unable to browse with my office Wireless network i am connected [closed]
I am unable to connect to the internet. I am behind a company router that requires authentication, and although I had provided it I am unable to connect out to the internet.
Everyone is able to ...
8
votes
2answers
196 views
Do any DNS registrars support multi factor authentication?
I am looking for a DNS registrar that supports strong multi-factor authentication.
Does any DNS registrar support multi-factor?
Is this a legitimate need?
0
votes
3answers
264 views
Some issues with iptables and nmap
When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default.
However I can use HTTP or SSH, so that ...
3
votes
2answers
2k views
Router admin password was changed, how did this happen and how to prevent [closed]
Internet was extremely spotty for about a week. I was on/off cycling the cable model and router almost daily, before I tried to sign into my router (198.162.1.1). When I did I was presented with a ...
5
votes
2answers
310 views
Unidentified public network sending traffic through my computer
I'm having a problem with one of my computers. I suspect it's being used for something malicious.
A few weeks ago my internet connection went down, I called my ISP and they told me that no MAC adress ...
1
vote
0answers
71 views
Secure DSL Modem/Gateway [closed]
I need a secure dsl modem. What I have found out over the last few months is that it is possible that a remote intruder, in lieu of being able to hack your computer itself, can gain control of the DSL ...
2
votes
1answer
176 views
What are the best Nmap Scripting Engine (NSE) service discovery scripts? [closed]
Using nmap -sV can be quite verbose can -sU can take a very long time especially with -p 0-65535. To narrow your results and enumerate interesting services the wealth of NSE scripts can be very ...
0
votes
1answer
121 views
How to Transfer packets from one ethernet card to another [closed]
I have a desktop with two ethernet(etho,eth1) cards and OSSIM installed in it. I have a laptop with webmin installed, where i want to write rules for transferring packets from eth1 to eth0. Both the ...
0
votes
1answer
135 views
Windows Firewall accepts a three-second unicast response from any source
I have read this article but still has some doubts may be after that...
The Windows Firewall feature in Microsoft Windows XP Service Pack 2
(SP 2) accepts a three-second unicast response from ...
6
votes
2answers
635 views
How can I detect if someone is sniffing network packets on the LAN?
I would like to know if there is a product or software that can detect if there is a sniffer currently on the network?
In other words is it possible at all to detect if there is a network card on ...
0
votes
2answers
82 views
Setting up a remote test environment correctly
My setup:
- Main Box (connected to network)
- VM1 : Linux
- VM2 : Windows 7
Both the VMs are running off VM Player and using Bridged: connected directly to the physical network and replicating ...
7
votes
3answers
361 views
Would publishing a network diagram make the network less secure?
I have found some social networking sites that focus on sharing architecture (network maps and diagrams) and configuration.
Does sharing this type of information decrease the security of my network?
...
-3
votes
3answers
147 views
wireless security concern [closed]
My small office has Netgear Router (N300 DGN2200). I had it secured using "password" . So any computer which needed access had to give the security password. But today a outsider accessed my router ...
2
votes
4answers
209 views
Detecting and filtering data over AC power lines?
Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication?
I'm not sure how difficult this is ...
2
votes
1answer
72 views
Seeing outboud connections to random domains, how do I isolate the app responsible?
Last night I loaded up Fiddler2 to do a little debugging and I saw three connections to domains like
hghefhhig
How can I go about isolating the application responsible?
I was thinking possibly ...
0
votes
1answer
72 views
Display all packets but not these TCP packets?
I'm trying to filter packets with wireshark, I would like to display all packets but terminal service communications, but if I do:
tcp.dstport != 3389 && tcp.srcport != 3389
It would ...
5
votes
4answers
927 views
How to detect eavesdropping by your ISP
I've noticed some funny behavior lately with my home Internet connection such as connections dropping frequently, rate limiting occuring, and packet loss.
I know how to get around this online, use a ...
5
votes
2answers
124 views
How serious is a local virus in terms of network security
I work at an insurance company in the U.S. My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the ...
2
votes
1answer
106 views
What security risks are involved with sending data over the internal network on Rackspace Cloud servers?
What are the risks involved with sending unencrypted data over the internal network with Rackspace Cloud Servers?
Assume the interfaces use iptables to filter IPs and ports so they only accept data ...
5
votes
1answer
4k views
TCP Peer unexpectedly shrunk window messages in dmesg log
We get quite few messages like these in our dmesg log on various servers.
TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired)
TCP: ...
20
votes
7answers
4k views
Why block outgoing network traffic with a firewall?
In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
-1
votes
2answers
138 views
How much chance does an attacker have in this situation?
nmap -p- IPADDRESSHERE
shows no opened ports for a router from public interface (router is an openwrt machine).
It drops all ICMP and only has IPv4 address (the only thing that it runs on public ...
3
votes
1answer
355 views
Identifying device based on the MAC address
Suppose we know that MAC address A belongs to a certain device (say an iPhone 5), and MAC address B also belongs to an iPhone 5. If we have a MAC address C which is in between A and B, does this ...
0
votes
3answers
254 views
What reputable site should I download Putty from?
I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code.
If you needed to download Putty for a high security Windows ...
1
vote
1answer
190 views
How to write Snort rules based on MAC address?
I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some ...
0
votes
0answers
98 views
Is LAN to LAN Tunnel best solution [closed]
Currently we have a remote site connected to our main location with a T1 serial connection.We just installed a 5520 ASA at our main site and have a cisco 2811 router with security pacakege on the ...
2
votes
3answers
165 views
Passwords In Securing Network Devices
I don't do anything with corporate IT and networking, but I know enough to handle and get networks going. Anyway, something I ran into in my travels when it comes to the occasions of working on ...
1
vote
2answers
481 views
How to check if a port can be accessed from the outside
I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine.
Is that possible at ...
2
votes
3answers
475 views
DDoS on LAN: How to Defend?
DDos on a wired network has to be extremely rare, since the intruder has to be physically connected to the network. However, let's say that it still managed to happen. How would you be able to defend ...
2
votes
2answers
159 views
Attacks surrounding /etc/hosts/
Although /etc/hosts/ is a file that comes up a lot in security, I am surprised to find there is no discussion here on this forum that describes how this can be used for an attack.
Thinking about it, ...
3
votes
2answers
194 views
Which ports are potential security risks for nmap?
I'm using nmap and I am having trouble finding which ports are dangerous and pose the greatest security risks.
Which ports are potential security risks for nmap?
I was thinking samba, telnet, vnc ...
4
votes
1answer
174 views
Accurately mapping networks for purposes of pentesting
I always love staring at those network topology diagrams you see posted up in schools and online. Obviously if you physically setup and configured everything, plotting out servers, subnets, routers ...
8
votes
1answer
179 views
Are multiple network interface still recommended in a virtualized world?
Before the virtualization era, it was recommended to have several network card on a physical server :
1 for production dedicated network (only application's stream like
http, SQL*NET, ...)
1 for ...
2
votes
1answer
2k views
How does pfsense block torrent traffic?
I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...
2
votes
3answers
216 views
Repudiation in Copyright Infringement (BitTorrent)
Seeing this question : How did an alleged illegal downloading be detected? sparked a question I have had for a long time.
How does repudiation/non-repudiation work in such cases ?
Argument: It is ...
1
vote
3answers
387 views
How can alleged illegal downloading be detected?
Joel Tenenbaum was accused of illegally downloading 30 songs. How might his action have been detected? Can anyone show a concrete method?
Update
Using a honey pot or monitoring the peers list makes ...
