Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

23
votes
3answers
4k views

My WiFi network is replaced by another network. Am I being hacked?

To begin with, I am not very computer savvy. I am an older person with an older computer and a 2003 Windows XP using Google Chrome for a browser. (If anyone is old enough to remember when Windows ...
0
votes
2answers
198 views

What can I do about being heavily port scanned?

I have two devices connected wirelessly to my Linksys router while running Symantec Endpoint Protection on my computer. A few days ago I started using the internet by connecting the cable directly to ...
1
vote
2answers
145 views

Strange 'agetty' process running on my VPS.

Recently, I had to reinstall one of my VPS servers (again), due to malware. I took what I considered to be pretty good security precautions. I also locked the root account and am using sudo as well. ...
7
votes
4answers
28k views

How to tell if you're being ARP poisoned?

I am having some issues at work and there is a new network admin in place. I think I am being monitored so decided to run ArpSpy X in two scenarios: Over WiFi bridge pluged into cisco router to took ...
-4
votes
1answer
80 views

If I am an admin of a WiFi router can I learn the password when it gets change by other admin? [on hold]

I have a Huawei WS319 router. The admin password is known to me and my friend. Is there any way to learn WiFi password (through automatic notification) if it gets changed in the future, given that I ...
1
vote
1answer
621 views

802.11 Authentication/Association and WPA/WPA2 authentication (Four-way handshake)

So I have read that 802.11 standard requires stations and APs to go through the authentication and association before communication can take place. I also know that WPA/WPA2 has its own authentication ...
-2
votes
0answers
47 views

How to reconcile IN data and GL data in a telecommunication billing system? [on hold]

I am involved in a system audit project on a telecom billing system, and my client wants to clarify the revenue data stored in the system is accurate and up to date. So, I am thinking to kick off the ...
1
vote
1answer
65 views

How do I scan for and discover active IPv6 addresses of devices behind a router?

Usually with IPv4 and NAT you can only access a device behind a router if the router is port-forwarded correctly or is the router's DMZ. When behind the router you can easily scan for the IPs behind ...
2
votes
0answers
120 views

Unknown MAC in network

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I ...
-4
votes
0answers
51 views

How does server process validates the credentials supplied by client in basic authentication [closed]

I am clear at high level what is happening in basic authentication. the portion what I am missing is, soon after server process receives windows account credentials from client, how does it validate ...
0
votes
0answers
50 views

How to check my public IP while i am using a cloud proxy? [closed]

I want to check my public ip. But I am using a cloud proxy so I check on internet by typing "what is my public ip" its shows ip which is cloud proxy ip. how can I check my real public ip??
0
votes
0answers
40 views

Is publishing Certificate Authority dangerous for a network?

I've created a server for our company and set up a local chat network for it using "Skype for Business" application. In order for the employees to log in using this application it asked a certificate ...
3
votes
3answers
625 views

Suspicious VMware connections that bypass firewall

I'm running VMware 5 and I have found that when I start up VMware I see two connections: TCP 10.100.100.161:55555->as-40816.engx.vmware.com:https (ESTABLISHED) TCP ...
0
votes
0answers
19 views

CIPSO & CALIPSO implementation

Trying to understand how to implement security labels into IP packets. There is minimal documentation. Can anyone assist on how one can do this? Do you need raw sockets, or is there an API that UDP ...
5
votes
3answers
1k views

Is it possible to sniff traffic of a remote network? (With admin access to router)

Me and a friend of mine are simulating a widespread scenario where router configurations are untouched (default passwords) and are visible from the internet. Him, acting as the victim, will constantly ...
1
vote
1answer
71 views

How can an un-trusted device connected to the LAN network infect others operating systems?

I have a various devices on my LAN network (Linux, Windows, Android device..), sometimes i allow others to connect to my LAN through , it is not possible to verify the safety of their machines, Let's ...
3
votes
1answer
163 views

A PC constantly scans my network for IP addresses using ARP

Using wireshark I have found that one PC on my network constantly scans for devices on the network using ARP, e.g. Who has 192.168.0.26? Tell 192.168.0.10 It does that approx. 2 times a second and ...
-3
votes
1answer
76 views

is SSL/TLS certificate vulnerable

To my understanding, the client verifies the server certificate by checking whether the issuer DN (Distinguished Name) is equal to the subject DN in the root certificate ? If this is the case, anyone ...
3
votes
1answer
216 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the ...
3
votes
2answers
77 views

What happens if you upload code with a file extension that a website permits (PNG for ex)?

Example is GitHub comments that only allow uploading images and PDF. What happens if someone uploads malicious code after he changed the file extension to something like PNG or PDF? Also don't get ...
1
vote
1answer
50 views

Nemesis packets not detected in wireshark/tcpdump

I have been using nemesis for forging fake DHCP request packets on my Ubuntu machine. I get a "packet injected" message each time I inject it. However I was not able to analyze it on wireshark as my ...
1
vote
0answers
23 views

Scapy problem in sending packet

I am trying to use Scapy for testing the network. Whenever I send a packet with commands like send, sr ,sr1 I get this message: python.exe has stopped working I am using Scapy 2.2.0 on Windows ...
0
votes
0answers
11 views

stopping router attack script using foreign addresses [duplicate]

I'm not a security expert but I've got someone using a script to attack my router. Sometimes it's every 10 minutes, but since I called the person out, it has increased in frequency. They are blocking ...
1
vote
1answer
76 views

Is this a reasonable approach of continous network monitoring?

I'm currently implementing some mechanisms to continuously monitor our network. Most of this is done through OSSIM but I also extended it by some self written monitoring scripts. Im currently doing ...
18
votes
4answers
3k views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reached the ...
1
vote
2answers
149 views

Kali Linux/Metasploit in VirtualBox - Issue with ports

I've been attempting to get port 4444 to open these past couple of days. I finally figured I'd try to get it working on my Windows machine first and I finally got it. Now, no matter what I do in the ...
0
votes
1answer
109 views

Is it safe to be showing my WAN and LAN IPs in my email headers?

I don't know how to hide my LAN IP from my email recipients. My LAN IP shows up next to my WAN IP in my outgoing email headers (sent to my other accounts and viewed by me). I have not seen emails sent ...
0
votes
1answer
48 views

Would changing my DNS get through i-Boss?

I'm not exactly sure how the web filter iBoss works but it doesn't seem to be installed on all the computers at my school so I was thinking it probably handles connections directly at the DNS level ...
3
votes
1answer
116 views

Monitoring an uninvited guest on my WLAN? [duplicate]

At home I configured a common, residential, consumer-grade wireless network. It is build from a Broadcom router connecting a few personal devices (i.e. my laptop & smartphone) to the Internet. My ...
1
vote
1answer
66 views

How to use nmap through proxychains?

Iam running nmap through proxychains using this comand proxychains nmap -v scanme.namp.org This produced an error showing like this root@kali:~# proxychains nmap -v scanme.nmap.org ...
3
votes
2answers
182 views

What information could be identified about a Virtual Machine which routed traffic via a VPN?

Background: I have a Virtual Machine which is running all it's traffic through a VPN (from within the Virtual Machine) so to obfuscate all web traffic. This Virtual Machine is running from within an ...
4
votes
1answer
202 views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
0
votes
1answer
48 views

Random IPs in ARP/RARP table with the same mac address?

I was looking at my router settings and saw a bunch of IPs with the same mac address in the ARP/RARP table. The GEOlocation of them all ranges across my country, any ideas to why they are there? ...
2
votes
2answers
144 views

Suspicious Network Activity - is my system compromised?

When using Firefox to open a blank page, I have a weird network connection that shows under Network Activity in Resource Monitor (Windows 7). The address is: insiders-guide.pacedev.com. A ...
3
votes
2answers
144 views

How to map a network passively with wireshark dumps?

I'm currently diving into network mapping and thought that in order to do this stealthily why not listen to the existing network traffic; a wireshark dump usually contains a metric ton of information ...
0
votes
0answers
3 views

Netflow on all interfaces? [migrated]

I'm reading up on Netflow and playing around in PacketTracer. Currently I'm using ip flow ingress/egress only on my Routers gigabitEthernet. How much overhead is required, is Netflow supposed to be ...
1
vote
0answers
54 views

Is it possible to identify the source of message in whatsapp?

Is it possible to identify the real source of message in whatsapp? Scenario : Texting whatsapp message to a group,one of the group member forwards it to another and it goes on atlast one day it ...
6
votes
1answer
97 views

Would a DMZ be safe to use with a software firewall for home networking?

If I set up a Windows 10 PC with a software firewall (TinyWall, which is a front end for Windows Firewall) and blocked all traffic except for a few applications and ports I would be using (Minecraft ...
4
votes
1answer
381 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
4
votes
1answer
141 views

What about Long Router Passwords and WPS Push-Buttons

I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my ...
0
votes
1answer
50 views

How is UDP hijacking even possible?

My doubt is this: UDP has no sequence numbers, so what indeed is the concept behind UDP session hijacking?
27
votes
5answers
5k views

Advantages to killing sessions after 5 minutes?

I'm dealing with a server that isn't mine to configure. Something somewhere between me and this server kills any connection after 5 minutes if no traffic passes between the two machines. This includes ...
-1
votes
2answers
36 views

RBAC togehter with AAA?

I'm taking a network course and my teacher has not been answering my emails. I'm supposed to set up "Role based access using privileges with AAA" I thought RBAC and AAA stood in contrast to one and ...
3
votes
1answer
131 views

Authenticate tracking device with TCP server

I am building a tracking device and am looking for a secure authentication method to use when the device wants to establish a connection to the server. The server is a TCP server that we open a ...
25
votes
3answers
3k views

Does using a live CD make you more vulnerable to remote attacks?

Some people recommend the use of a Linux live CD for online banking, but doesn't that make you more vulnerable to network attacks since it's not updated? I tried installing updates and it required me ...
4
votes
1answer
973 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
-5
votes
3answers
12k views

How to hide my ip and browsing history from others on my network? [duplicate]

I need to hide my activity and IP address from those I share this network with. I'm unsure if a VPN will serve my needs, because I'm not concerned about the sites I access tracking me. I'm concerned ...
8
votes
4answers
9k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
6
votes
4answers
3k views

Security provided through MAC filtering: Wired vs. Wireless Networks

My question refers to the following article on Wikipedia: MAC Filtering. The article states: MAC filtering is not effective control in wireless network as attackers can eavesdrop on wireless ...
1
vote
0answers
55 views

I am hoping someone can shed some light on these nmap scan results

I am concerned that a friends computer may be compromised. They were complaining about the computer getting really hot, difficulty maintaining an online connection, finding unread non junk emails in ...