Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

7
votes
3answers
12k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
0
votes
2answers
143 views

Can a second router be used as an artificial firewall?

I was wondering if I can make an artificial firewall by using two routers (Referred as Router 1 and Router 2). My server will be on router #1 while router #2 hosts all the other devices on my network. ...
-4
votes
0answers
44 views

Can some one please share guide / references / resources for Network Security Testing [on hold]

***Hi All, I am looking for basic details about Network Security Testing (For example: how to perform Network Security Testing and its checklist, list of the tools we require etc.) Thanks***
0
votes
2answers
45 views

How to write bug in proper format [on hold]

I want to know the proper format in which a bug about a particular site should be written. It's a localized question. Is it legal to report a bug or will it be considered spam?
4
votes
1answer
384 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
4
votes
1answer
158 views

What about Long Router Passwords and WPS Push-Buttons

I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my ...
0
votes
0answers
19 views

Limiting access to data in a web application from IPs outside the network

My goal is to build a system (PHP + MySQL) where a user will have access to particular data only when logged in locally (from one of the office computers with a local IP), and to all the non-sensitive ...
0
votes
2answers
38 views

Stateful Packet Filter structure

http://postimg.org/image/o1ojanqq3/ For stateful packet filter, Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter? Secondly, how can stateful ...
0
votes
1answer
17 views

Application proxy structure & funtions

http://postimg.org/image/76newirnv/ For application proxy, Firstly, what does it mean "A proxy is something that acts on your behalf"? Can anyone give a more detail explanation about proxy? I read ...
1
vote
2answers
29 views

Packet Filter vs Application proxy

http://postimg.org/image/b1w3bujnv/ I don't understand the highlighted part in red. Firstly,Why is a packet filter is enough in a situation where traffic is busy? Secondly,Isn't application proxy ...
0
votes
2answers
65 views

Nmap says host down, but host is up

I am using nmap 7.12 on Mac OS X. I haven’t been able to find a solution to my issue. The host that is being scanned is a Linux RHEL server in VirtualBox. I can ping the server and receive ICMP ...
0
votes
1answer
40 views

Packet Filter with Access Control List

http://i66.tinypic.com/29p50zp.png Can anyone explain how to read and understand row 1,2 and 3? My understanding for row 1 is : If any inside packets want to go to outside via any source port to ...
1
vote
1answer
50 views

What is a device that scans the network it is connected to called?

Are there any devices (computer, switch, router, etc.) witch integrate licensed software like Nessus or Nexpose in a way that you can just drop them in a network and scan that network remote? If so, ...
-1
votes
0answers
25 views

About Arp attack [on hold]

we have the suspect of MITM attack but we are not sure. So I install XARP on the computer. The log is clean but one computer of the net have a very higth value in the coloumn how often seen. It's ...
1
vote
4answers
13k views

Unknown MAC address connected to router

I found an unknown MAC address connected to my home router. How would I figure out what OS the IP or MAC address is running?
0
votes
2answers
58 views

Setting up a secure VM and protecting host network

I'm an intern doing research on different honeypots, and I'm planning to test a few on a VM. However, I'm on a company network and would like to have my VM as secure as possible. I've read that VMs ...
6
votes
2answers
1k views

How does HSTS stop MitM attacks?

I know that until a few years ago, someone could set up a fake wireless AP, and use something like SSLStrip to lure the victims into connecting to insecure versions of the major websites, such as ...
40
votes
5answers
9k views

My WiFi network is replaced by another network. Am I being hacked?

To begin with, I am not very computer savvy. I am an older person with an older computer and a 2003 Windows XP using Google Chrome for a browser. (If anyone is old enough to remember when Windows ...
1
vote
1answer
114 views

How to pick an enterprise VPN provider?

We have always deployed our own VPN using an open source package, but as our company is growing we've become increasingly aware of the importance of scaling this solution, especially now we operate ...
4
votes
1answer
986 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
3
votes
1answer
67 views

Is it possible to hack WPS PIN of routers that lockout exponentially after failed tries?

I have been interested in Wireless hacking lately, and I can do dictionary attacks, and some other type of attacks. Though, I wanted to hack my ASUS RT-N12D1 router's WPS PIN. ASUS doesn't alllow to ...
-3
votes
0answers
55 views

How to reconcile IN data and GL data in a telecommunication billing system? [closed]

I am involved in a system audit project on a telecom billing system, and my client wants to clarify the revenue data stored in the system is accurate and up to date. So, I am thinking to kick off the ...
0
votes
2answers
202 views

What can I do about being heavily port scanned?

I have two devices connected wirelessly to my Linksys router while running Symantec Endpoint Protection on my computer. A few days ago I started using the internet by connecting the cable directly to ...
1
vote
2answers
146 views

Strange 'agetty' process running on my VPS.

Recently, I had to reinstall one of my VPS servers (again), due to malware. I took what I considered to be pretty good security precautions. I also locked the root account and am using sudo as well. ...
7
votes
4answers
28k views

How to tell if you're being ARP poisoned?

I am having some issues at work and there is a new network admin in place. I think I am being monitored so decided to run ArpSpy X in two scenarios: Over WiFi bridge pluged into cisco router to took ...
-4
votes
1answer
84 views

If I am an admin of a WiFi router can I learn the password when it gets change by other admin? [closed]

I have a Huawei WS319 router. The admin password is known to me and my friend. Is there any way to learn WiFi password (through automatic notification) if it gets changed in the future, given that I ...
1
vote
1answer
622 views

802.11 Authentication/Association and WPA/WPA2 authentication (Four-way handshake)

So I have read that 802.11 standard requires stations and APs to go through the authentication and association before communication can take place. I also know that WPA/WPA2 has its own authentication ...
1
vote
1answer
67 views

How do I scan for and discover active IPv6 addresses of devices behind a router?

Usually with IPv4 and NAT you can only access a device behind a router if the router is port-forwarded correctly or is the router's DMZ. When behind the router you can easily scan for the IPs behind ...
2
votes
0answers
123 views

Unknown MAC in network

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I ...
0
votes
0answers
40 views

Is publishing Certificate Authority dangerous for a network?

I've created a server for our company and set up a local chat network for it using "Skype for Business" application. In order for the employees to log in using this application it asked a certificate ...
3
votes
3answers
630 views

Suspicious VMware connections that bypass firewall

I'm running VMware 5 and I have found that when I start up VMware I see two connections: TCP 10.100.100.161:55555->as-40816.engx.vmware.com:https (ESTABLISHED) TCP ...
0
votes
0answers
21 views

CIPSO & CALIPSO implementation

Trying to understand how to implement security labels into IP packets. There is minimal documentation. Can anyone assist on how one can do this? Do you need raw sockets, or is there an API that UDP ...
5
votes
3answers
1k views

Is it possible to sniff traffic of a remote network? (With admin access to router)

Me and a friend of mine are simulating a widespread scenario where router configurations are untouched (default passwords) and are visible from the internet. Him, acting as the victim, will constantly ...
1
vote
1answer
76 views

How can an un-trusted device connected to the LAN network infect others operating systems?

I have a various devices on my LAN network (Linux, Windows, Android device..), sometimes i allow others to connect to my LAN through , it is not possible to verify the safety of their machines, Let's ...
3
votes
1answer
168 views

A PC constantly scans my network for IP addresses using ARP

Using wireshark I have found that one PC on my network constantly scans for devices on the network using ARP, e.g. Who has 192.168.0.26? Tell 192.168.0.10 It does that approx. 2 times a second and ...
-3
votes
1answer
81 views

is SSL/TLS certificate vulnerable

To my understanding, the client verifies the server certificate by checking whether the issuer DN (Distinguished Name) is equal to the subject DN in the root certificate ? If this is the case, anyone ...
3
votes
1answer
217 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the ...
3
votes
2answers
77 views

What happens if you upload code with a file extension that a website permits (PNG for ex)?

Example is GitHub comments that only allow uploading images and PDF. What happens if someone uploads malicious code after he changed the file extension to something like PNG or PDF? Also don't get ...
1
vote
1answer
51 views

Nemesis packets not detected in wireshark/tcpdump

I have been using nemesis for forging fake DHCP request packets on my Ubuntu machine. I get a "packet injected" message each time I inject it. However I was not able to analyze it on wireshark as my ...
1
vote
0answers
24 views

Scapy problem in sending packet

I am trying to use Scapy for testing the network. Whenever I send a packet with commands like send, sr ,sr1 I get this message: python.exe has stopped working I am using Scapy 2.2.0 on Windows ...
0
votes
0answers
11 views

stopping router attack script using foreign addresses [duplicate]

I'm not a security expert but I've got someone using a script to attack my router. Sometimes it's every 10 minutes, but since I called the person out, it has increased in frequency. They are blocking ...
1
vote
1answer
76 views

Is this a reasonable approach of continous network monitoring?

I'm currently implementing some mechanisms to continuously monitor our network. Most of this is done through OSSIM but I also extended it by some self written monitoring scripts. Im currently doing ...
18
votes
4answers
3k views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reached the ...
1
vote
2answers
153 views

Kali Linux/Metasploit in VirtualBox - Issue with ports

I've been attempting to get port 4444 to open these past couple of days. I finally figured I'd try to get it working on my Windows machine first and I finally got it. Now, no matter what I do in the ...
0
votes
1answer
109 views

Is it safe to be showing my WAN and LAN IPs in my email headers?

I don't know how to hide my LAN IP from my email recipients. My LAN IP shows up next to my WAN IP in my outgoing email headers (sent to my other accounts and viewed by me). I have not seen emails sent ...
0
votes
1answer
48 views

Would changing my DNS get through i-Boss?

I'm not exactly sure how the web filter iBoss works but it doesn't seem to be installed on all the computers at my school so I was thinking it probably handles connections directly at the DNS level ...
3
votes
1answer
118 views

Monitoring an uninvited guest on my WLAN? [duplicate]

At home I configured a common, residential, consumer-grade wireless network. It is build from a Broadcom router connecting a few personal devices (i.e. my laptop & smartphone) to the Internet. My ...
1
vote
1answer
76 views

How to use nmap through proxychains?

Iam running nmap through proxychains using this comand proxychains nmap -v scanme.namp.org This produced an error showing like this root@kali:~# proxychains nmap -v scanme.nmap.org ...
3
votes
2answers
183 views

What information could be identified about a Virtual Machine which routed traffic via a VPN?

Background: I have a Virtual Machine which is running all it's traffic through a VPN (from within the Virtual Machine) so to obfuscate all web traffic. This Virtual Machine is running from within an ...
4
votes
1answer
216 views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...