Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

0
votes
2answers
27 views

Stateful Packet Filter structure

http://postimg.org/image/o1ojanqq3/ For stateful packet filter, Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter? Secondly, how can stateful ...
0
votes
1answer
15 views

Application proxy structure & funtions

http://postimg.org/image/76newirnv/ For application proxy, Firstly, what does it mean "A proxy is something that acts on your behalf"? Can anyone give a more detail explanation about proxy? I read ...
1
vote
2answers
24 views

Packet Filter vs Application proxy

http://postimg.org/image/b1w3bujnv/ I don't understand the highlighted part in red. Firstly,Why is a packet filter is enough in a situation where traffic is busy? Secondly,Isn't application proxy ...
0
votes
2answers
56 views

Nmap says host down, but host is up

I am using nmap 7.12 on Mac OS X. I haven’t been able to find a solution to my issue. The host that is being scanned is a Linux RHEL server in VirtualBox. I can ping the server and receive ICMP ...
0
votes
1answer
30 views

Packet Filter with Access Control List

http://i66.tinypic.com/29p50zp.png Can anyone explain how to read and understand row 1,2 and 3? My understanding for row 1 is : If any inside packets want to go to outside via any source port to ...
1
vote
1answer
45 views

What is a device that scans the network it is connected to called?

Are there any devices (computer, switch, router, etc.) witch integrate licensed software like Nessus or Nexpose in a way that you can just drop them in a network and scan that network remote? If so, ...
-1
votes
0answers
22 views

About Arp attack

we have the suspect of MITM attack but we are not sure. So I install XARP on the computer. The log is clean but one computer of the net have a very higth value in the coloumn how often seen. It's ...
1
vote
4answers
13k views

Unknown MAC address connected to router

I found an unknown MAC address connected to my home router. How would I figure out what OS the IP or MAC address is running?
0
votes
2answers
58 views

Setting up a secure VM and protecting host network

I'm an intern doing research on different honeypots, and I'm planning to test a few on a VM. However, I'm on a company network and would like to have my VM as secure as possible. I've read that VMs ...
6
votes
2answers
1k views

How does HSTS stop MitM attacks?

I know that until a few years ago, someone could set up a fake wireless AP, and use something like SSLStrip to lure the victims into connecting to insecure versions of the major websites, such as ...
40
votes
5answers
9k views

My WiFi network is replaced by another network. Am I being hacked?

To begin with, I am not very computer savvy. I am an older person with an older computer and a 2003 Windows XP using Google Chrome for a browser. (If anyone is old enough to remember when Windows ...
1
vote
1answer
113 views

How to pick an enterprise VPN provider?

We have always deployed our own VPN using an open source package, but as our company is growing we've become increasingly aware of the importance of scaling this solution, especially now we operate ...
4
votes
1answer
981 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
3
votes
1answer
61 views

Is it possible to hack WPS PIN of routers that lockout exponentially after failed tries?

I have been interested in Wireless hacking lately, and I can do dictionary attacks, and some other type of attacks. Though, I wanted to hack my ASUS RT-N12D1 router's WPS PIN. ASUS doesn't alllow to ...
-3
votes
0answers
54 views

How to reconcile IN data and GL data in a telecommunication billing system? [closed]

I am involved in a system audit project on a telecom billing system, and my client wants to clarify the revenue data stored in the system is accurate and up to date. So, I am thinking to kick off the ...
0
votes
2answers
201 views

What can I do about being heavily port scanned?

I have two devices connected wirelessly to my Linksys router while running Symantec Endpoint Protection on my computer. A few days ago I started using the internet by connecting the cable directly to ...
1
vote
2answers
146 views

Strange 'agetty' process running on my VPS.

Recently, I had to reinstall one of my VPS servers (again), due to malware. I took what I considered to be pretty good security precautions. I also locked the root account and am using sudo as well. ...
7
votes
4answers
28k views

How to tell if you're being ARP poisoned?

I am having some issues at work and there is a new network admin in place. I think I am being monitored so decided to run ArpSpy X in two scenarios: Over WiFi bridge pluged into cisco router to took ...
-4
votes
1answer
83 views

If I am an admin of a WiFi router can I learn the password when it gets change by other admin? [closed]

I have a Huawei WS319 router. The admin password is known to me and my friend. Is there any way to learn WiFi password (through automatic notification) if it gets changed in the future, given that I ...
1
vote
1answer
622 views

802.11 Authentication/Association and WPA/WPA2 authentication (Four-way handshake)

So I have read that 802.11 standard requires stations and APs to go through the authentication and association before communication can take place. I also know that WPA/WPA2 has its own authentication ...
1
vote
1answer
67 views

How do I scan for and discover active IPv6 addresses of devices behind a router?

Usually with IPv4 and NAT you can only access a device behind a router if the router is port-forwarded correctly or is the router's DMZ. When behind the router you can easily scan for the IPs behind ...
2
votes
0answers
123 views

Unknown MAC in network

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I ...
0
votes
0answers
40 views

Is publishing Certificate Authority dangerous for a network?

I've created a server for our company and set up a local chat network for it using "Skype for Business" application. In order for the employees to log in using this application it asked a certificate ...
3
votes
3answers
628 views

Suspicious VMware connections that bypass firewall

I'm running VMware 5 and I have found that when I start up VMware I see two connections: TCP 10.100.100.161:55555->as-40816.engx.vmware.com:https (ESTABLISHED) TCP ...
0
votes
0answers
21 views

CIPSO & CALIPSO implementation

Trying to understand how to implement security labels into IP packets. There is minimal documentation. Can anyone assist on how one can do this? Do you need raw sockets, or is there an API that UDP ...
5
votes
3answers
1k views

Is it possible to sniff traffic of a remote network? (With admin access to router)

Me and a friend of mine are simulating a widespread scenario where router configurations are untouched (default passwords) and are visible from the internet. Him, acting as the victim, will constantly ...
1
vote
1answer
74 views

How can an un-trusted device connected to the LAN network infect others operating systems?

I have a various devices on my LAN network (Linux, Windows, Android device..), sometimes i allow others to connect to my LAN through , it is not possible to verify the safety of their machines, Let's ...
3
votes
1answer
167 views

A PC constantly scans my network for IP addresses using ARP

Using wireshark I have found that one PC on my network constantly scans for devices on the network using ARP, e.g. Who has 192.168.0.26? Tell 192.168.0.10 It does that approx. 2 times a second and ...
-3
votes
1answer
80 views

is SSL/TLS certificate vulnerable

To my understanding, the client verifies the server certificate by checking whether the issuer DN (Distinguished Name) is equal to the subject DN in the root certificate ? If this is the case, anyone ...
3
votes
1answer
216 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the ...
3
votes
2answers
77 views

What happens if you upload code with a file extension that a website permits (PNG for ex)?

Example is GitHub comments that only allow uploading images and PDF. What happens if someone uploads malicious code after he changed the file extension to something like PNG or PDF? Also don't get ...
1
vote
1answer
51 views

Nemesis packets not detected in wireshark/tcpdump

I have been using nemesis for forging fake DHCP request packets on my Ubuntu machine. I get a "packet injected" message each time I inject it. However I was not able to analyze it on wireshark as my ...
1
vote
0answers
24 views

Scapy problem in sending packet

I am trying to use Scapy for testing the network. Whenever I send a packet with commands like send, sr ,sr1 I get this message: python.exe has stopped working I am using Scapy 2.2.0 on Windows ...
0
votes
0answers
11 views

stopping router attack script using foreign addresses [duplicate]

I'm not a security expert but I've got someone using a script to attack my router. Sometimes it's every 10 minutes, but since I called the person out, it has increased in frequency. They are blocking ...
1
vote
1answer
76 views

Is this a reasonable approach of continous network monitoring?

I'm currently implementing some mechanisms to continuously monitor our network. Most of this is done through OSSIM but I also extended it by some self written monitoring scripts. Im currently doing ...
18
votes
4answers
3k views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reached the ...
1
vote
2answers
153 views

Kali Linux/Metasploit in VirtualBox - Issue with ports

I've been attempting to get port 4444 to open these past couple of days. I finally figured I'd try to get it working on my Windows machine first and I finally got it. Now, no matter what I do in the ...
0
votes
1answer
109 views

Is it safe to be showing my WAN and LAN IPs in my email headers?

I don't know how to hide my LAN IP from my email recipients. My LAN IP shows up next to my WAN IP in my outgoing email headers (sent to my other accounts and viewed by me). I have not seen emails sent ...
0
votes
1answer
48 views

Would changing my DNS get through i-Boss?

I'm not exactly sure how the web filter iBoss works but it doesn't seem to be installed on all the computers at my school so I was thinking it probably handles connections directly at the DNS level ...
3
votes
1answer
116 views

Monitoring an uninvited guest on my WLAN? [duplicate]

At home I configured a common, residential, consumer-grade wireless network. It is build from a Broadcom router connecting a few personal devices (i.e. my laptop & smartphone) to the Internet. My ...
1
vote
1answer
71 views

How to use nmap through proxychains?

Iam running nmap through proxychains using this comand proxychains nmap -v scanme.namp.org This produced an error showing like this root@kali:~# proxychains nmap -v scanme.nmap.org ...
3
votes
2answers
182 views

What information could be identified about a Virtual Machine which routed traffic via a VPN?

Background: I have a Virtual Machine which is running all it's traffic through a VPN (from within the Virtual Machine) so to obfuscate all web traffic. This Virtual Machine is running from within an ...
4
votes
1answer
207 views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
0
votes
1answer
48 views

Random IPs in ARP/RARP table with the same mac address?

I was looking at my router settings and saw a bunch of IPs with the same mac address in the ARP/RARP table. The GEOlocation of them all ranges across my country, any ideas to why they are there? ...
2
votes
2answers
144 views

Suspicious Network Activity - is my system compromised?

When using Firefox to open a blank page, I have a weird network connection that shows under Network Activity in Resource Monitor (Windows 7). The address is: insiders-guide.pacedev.com. A ...
3
votes
2answers
146 views

How to map a network passively with wireshark dumps?

I'm currently diving into network mapping and thought that in order to do this stealthily why not listen to the existing network traffic; a wireshark dump usually contains a metric ton of information ...
0
votes
0answers
3 views

Netflow on all interfaces? [migrated]

I'm reading up on Netflow and playing around in PacketTracer. Currently I'm using ip flow ingress/egress only on my Routers gigabitEthernet. How much overhead is required, is Netflow supposed to be ...
1
vote
0answers
56 views

Is it possible to identify the source of message in whatsapp?

Is it possible to identify the real source of message in whatsapp? Scenario : Texting whatsapp message to a group,one of the group member forwards it to another and it goes on atlast one day it ...
6
votes
1answer
101 views

Would a DMZ be safe to use with a software firewall for home networking?

If I set up a Windows 10 PC with a software firewall (TinyWall, which is a front end for Windows Firewall) and blocked all traffic except for a few applications and ports I would be using (Minecraft ...
4
votes
1answer
381 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...