How could I be sure that the network cable is safe to use?

Question

There are Cat 5 network cables in the office going from some rooms to some other rooms through the walls and the ceiling.

The office belonged to another company in the past, which means that there is no guarantee that nobody installed a tracking device in the walls, or that the cable doesn't go to a different office in the building, where it can be tampered with.

Is there anything which can be done using hardware or software on both sides of the cable to ensure that the cable was not tampered with (in other words, that this is indeed a single cable, and not two ones connected through a device such as a switch)? Or the actual, physical inspection is the only way?

---

To reduce the scope of the question, I'm talking about ordinary tampering by introducing a basic switch which can track what gets through it (and possibly redirect the traffic to another port for inspection, as most switches are able to do). Of course, this excludes military-grade devices which are specifically designed to not only trace the communication, but also resist any attempt to identify them.

Answer 1

I would try to use a cable analyzer for example the DSX-5000 from Fluke. This analyzer should be able to guarantee the continuity of each cable and its characteristics. That should be enough to detect the presence of an unwanted switch or any port mirroring device.

Maybe a simple continuity tester could be enough, but a more professional/expensive cable analyzer could give the cable length, propagation delay, and many other physical elements that could be changed even by a derivation on a line. The hard part would still be to correctly interpret the results, but any strong difference from the standard measures would be a hint that something weird could be there...

Answer 2

The method that would be employed to solve this would involve comparing the MAC addresses that the network switch ports say are on the other end of each wire, against a list of what those MAC addresses should be. The trick is gathering the list of the MAC addresses, because without actually inventorying the clients and recording their MAC addresses, it would require some discovery automation tooling.

A properly secured network should not allow a device to be plugged in that is not known and authorized to be on the network. Some corporations have this setup and a device that is placed on the network that isn't known to the network will not get an ip address, etc. Some companies have this somewhat worked out such that unknown devices can plug in and connect and get an IP address, but an alert gets sent to the security ops center to investigate. Most companies have nothing in place to prevent or even detect.

If you suspect that the existing cabling might be compromised to begin with then start with the strictest setup to have dhcp deny unknown clients, and perform a discovery of the clients and make them known in dhcp. GHow you do that specifically would vary based on what you use as a DHCP server.

It would also be a good idea to have an intrusion detection system (IDS) that is configured to detect and alert on services running on your network that shouldn't be. For example, a rogue DHCP server, DNS server, access point, etc. How you do this specifically would depend on what IDS platform you select. Snort is mature and stable and full featured and cost-effective:

SNORT Intrusion Detection

It would be best to have an IDS in place even if you don't suspect your network is compromised, and even if you have a good inventory of clients and MAC addresses and only those are allowed. The reason is any of the clients could become compromised and malicious services installed. The MAC address of the compromised client won't change but now that client has become a rogue device.