0

I have servers on a LAN reporting my laptop with a bogus hostname. This is making me suspect a man in the middle attack.

Here are some details:

From an Ubuntu Linux 14.04 laptop, I logged into an Ubuntu server to do some bandwidth monitoring with a tool call jnettop.

jnettop lists all computers connected to the server and how much bandwidth each connection is consuming.

On a debian-based linux you can install jnettop like this:

sudo apt-get install jnettop

And to run jnettop, you type a command specifying the network interface you want to listen on, like this:

sudo jnettop -i eth0

Naturally, one of the connections jnettop listed was my own port 22 connection with the server. It correctly indicated my local ip address, but for my host name it said I was julianm.domain.local; I was expecting it to say myActualHostname.domain.local

As a hostname, "julianm" is definitely not something I recognize and I'm concerned I may be falling victim to a man in the middle attack. What are other explanations as to why jnettop would report an incorrect hostname for its connection with this laptop?

Any advice would be appreciated. Thanks.

Improve this question

1 Answer 1

Reset to default
2

It is possible that is what is happening. Assuming this isn't a super sophisticated attack, let's take a basic overview of what to do:

First, check your Domain Name Server (DNS) to get a mapping of current IPs to Media Access Control (MAC) addresses.

Next, you need to log-in to your network switch(es). Within your switch, you will be able to view the Content Addressable Memory (CAM) tables. These tables map each MAC address to the physical port that they are plugged into on the switch.

Once you have the physical port, you can go to that location and look for a bad actor. Additionally, unless the MITM is spoofing their MAC, you may also be tipped off as to what kind of device to look for by looking up their vendor code: Mac Vendor Lookup

This process can be further complicated by unsecure wireless access points.

Improve this answer
3
  • I've been worried about our wireless access points being on the same LAN as our workstations and servers. They do require credentials, but I don't trust that is enough. I've been meaning to figure out how to break the network up into vLans using our managed switches, but I keep getting distracted onto other projects. I don't follow security news, but my on gut tells me that mobile phones connecting at the work place is going to be a huge problem soon (if it isn't already). These devices must be segregated from corporate LANs. It feels very urgent to me.
    – Lonnie Best
    Commented Jan 23, 2015 at 19:00
  • 1
    If you have the resources to do so, I would suggest exactly that. A separate VLAN for businesses with a Bring-Your-Own-Device (BYOD) policy, in this case phones, is an excellent way of isolating workstations from "non-work" stations. With managed switches you should be able to build a comprehensive network map, and lock certain MAC addresses to certain ports. For ports that are tucked out of the way a default "disabled" setting is the way to go. Specific implementation would obviously have to be tailored to your layout... and it probably wouldn't be without growing pains.
    – Ramrod
    Commented Jan 23, 2015 at 19:09
  • This turned out to be caused by an old reverse dns lookup zone entry timestamped in 2010.
    – Lonnie Best
    Commented Jan 26, 2015 at 5:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .