1

Have noticed that I can scan the network though I have set an arp limit rate on the Cisco switch switchport and need some recommendations.

The previous engineer set an arp rate limit of 200 and probably with good reason too... looking at you Windows OS! :-)

But that allowed strangers to connect their laptops to the network and scan it. I've set the arp limit to 50 which triggers into the 'err-disable' state soon after I start scanning.

But if I scan a different subnet to the one I'm currently connected to, the switchport does not go into err-disable and I can successfully scan.

Can anyone recommend some reading materials and provide tips if any to mitigate this?

Thanks in advance for any assistance.

3
  • 1
    " ... if I scan a different subnet to the one I'm currently connected to ..." - By design ARP covers only the current subnet, so any ARP based protections can not work when crossing subnets. Such protections need to be added in the other subnet again. Sep 28, 2020 at 20:11
  • Yes thank you for the response, I concur. It appears to be only viable for the current subnet. I'm going to look up of the likes of Bro/Suricata/etc can help somehow. Still would appreciate any suggestions from anyone towards this hurdle.
    – user4565
    Sep 28, 2020 at 21:44
  • 1
    It's ineffective to make mitigation against network mapping & service detection. At least to my knowledge, people will always find a way. What you may do is to setup a service which will log and notify when someone is making a contact with it. That would give you more valuable information; you'll see who is scanning. Sep 29, 2020 at 6:44

1 Answer 1

1

When a system accesses an IP address outside it's subnet, it will try to access the gateway. So, for every IP address outside the subnet, the ARP will be for the IP address of the gateway. You cannot limit this in a switch (a "real" switch).

So, you must look at the router. It depends a bit what that router is, but in general, routers do not limit the number of IP addresses that can be accessed.

If you want to detect and take action, you should probably look at netflow. Based on the netflow data, you can detect network mapping. You can also take actions, from visiting the location, to automatically shut of the switchport.

1
  • Thanks for that. The 'routers' in this environment are your usual L3 switches with SVIs as the gateways. Exporting netflow (sflow, ipfix or other) to something worthwhile investing into should have other benefits such as detecting other anomalous events. Hmm, my preference is to use something that is opensource but commercially supported... google is my best friend here :-)
    – user4565
    Sep 29, 2020 at 19:23

Not the answer you're looking for? Browse other questions tagged .