I am on a WiFi network with a SonicWall router (I'm guessing this comes with an IDS).

If someone on my network launches an MiTM attack on me, will the network admin be able to detect this?

Does an IDS/IPS/Network Firewall prevent such an attack?

Or do I have to be vigilant and protect myself against such an attack?

  • 2
    What do you mean "be vigilant and protect myself"? Why would you not be vigilant even if the network admin could detect a MiTM. – Neil Smithline Dec 25 '15 at 20:21
  • 3
    Are you specifically talking about an SSL MiTM or something more general? If so, what? – Neil Smithline Dec 25 '15 at 20:21
  • You're right, better be safe than sorry. I mean specifically, ARP Poisoning and DNS Spoofing. – Bob Bob Dec 25 '15 at 20:54
  • An Intrusion Detection System that looks at router traffic can detect those things. – Natanael Dec 25 '15 at 23:33
  • You should refer this question security.stackexchange.com/questions/12066/… – Krishna Pandey Dec 26 '15 at 3:50

It depends on the location of the IDS relative to the network and on the capabilities of the IDS.

ARP or DHCP spoofing attacks are done inside the local network. From outside this network they look no different than normal connections. Thus in order to detect such attacks the IDS has to be inside the same network where the attack occurs. ARP and DHCP spoofing attacks can also sometimes already be prevented by better routers without needing an IDS.

DNS spoofing can be done inside the network or from outside. If the attack happens inside, then an IDS outside of the network will not be able to detect this attack, although it might in theory detect some results of the attack. On such results might be the attempt to access a specific web server on the wrong IP address which could be detected by comparing the Host header in the request against the target IP address.

If DNS spoofing is done from outside the network protected by the IDS, then the IDS might be able to detect such attacks, depending on how sophisticated they are.

Apart from the theoretical limits which kinds of attacks can be attacked because of the location of the IDS in the network, there are practical limits on detection capabilities which depend on the type of IDS, the specific configuration etc. Thus even if attacks could in theory be detected, a specific IDS with a specific configuration might not be able to do it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.