Questions tagged [network]

Security of network infrastructure and network traffic. For questions about security of network equipment, topology, protocols, traffic, administration, and configuration. Related tags: [packet], [firewall], [network-scanners], [network-access-control].

Filter by
Sorted by
Tagged with
15
votes
5answers
4k views

Are consumer-grade routers any more or less vulnerable? [closed]

I apologize if this is an obvious question, I'm not very familiar with hardware. I am planning on hosting a few personal websites from my home, but I'm concerned about my security. I'm using a fairly ...
13
votes
3answers
11k views

Can IT see my Google Drive traffic? [duplicate]

I'm on my phone but on the work network. What could they see about my Google Drive traffic? Could they see folder and file names? Could they see documents and photos? It's encrypted, so would they ...
9
votes
2answers
1k views

Does DNSSec have any benefit if used with IPSec-enabled IPv6?

I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec? Is DNSSec an IPv4-only technology?
6
votes
6answers
18k views

monitoring outgoing network traffic [closed]

The graphs for one server that I am using are showing consistent 7.5 kb/s outgoing network traffic that started a few days ago. How can I monitor/log/capture/analize this traffic to see what is it, ...
12
votes
5answers
20k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
24
votes
4answers
4k views

IPsec (Internet Protocol Security) facts

Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
20
votes
4answers
17k views

Can home routers get infected?

I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection? I used the search bar but ...
19
votes
4answers
4k views

Threat assesment for a captive portal

I am interested in setting up a captive portal on a wireless network. From what I understand I would do this by initially having all guests in a temporary vlan, moving them to the real vlan when ...
12
votes
5answers
2k views

Powerful security tools to use in penetration testing

I want to ask you about some good security tools you've used or heard about, please let us know the ability in every tool and the difficulty to use it and which is the best situation to use this tool ....
11
votes
3answers
2k views

What free tools or techniques exist to discover anomalies in network flows?

I have been using FlowMatrix. What do others do on the cheap?
10
votes
4answers
5k views

How to prevent network administrators from accessing USB drive

How can I prevent network administrators from accessing, mapping to etc. a USB drive that's in a PC on their network? I'm mainly concerned about files being edited or deleted.
8
votes
1answer
1k views

What are the main issues and best practice security controls when exposing SIP and H.323 to the Internet?

What are the main issues and recommended controls when exposing SIP and H.323 to the Internet (could be for voice, video, and instant messaging traffic or all three)? Specifically I'm looking for ...
3
votes
2answers
7k views

Using Cain and Abel to capture traffic of machine in the same network

I have installed Cain and Able in machine A, which is connected to another machine B via a LAN. Now I want to analyze all the traffic of machine B. Is this possible by installing Cain and Abel on ...
10
votes
3answers
11k views

Doesn't an IP conflict occur when ARP spoofing?

I am playing around with Ettercap and ARP spoofing attacks. I have noticed that the computers that are involved in my attack not are displaying any messages telling that an IP conflict has occured. ...
15
votes
3answers
5k views

Bruteforce attack on my FTP server

I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", "...
14
votes
2answers
6k views

What's the diff between blocking a port with a firewall and not starting a service on that port in the first place?

I was considering setting up a software firewall (pf) on my web server and did some research on them. Were I to do it, it'd involve basically blocking connections to all ports except 80, 443, and the ...
11
votes
3answers
2k views

What security measures should be taken when running a Linux web server out of our office?

I am interested in running our company's web server from our local office. The office makes use of file sharing and NAS devices among other common office protocols. The worst case scenarios I've ...
8
votes
2answers
7k views

Scanning my network with NMAP

Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
7
votes
2answers
2k views

TLS 1.3 Makes Security Tools Obsolete?

I am a student and relative noob in IT security performing research for three reasons: school, my employer and personal curiosity, and I hoped maybe someone could answer a question for me. In a video ...
4
votes
3answers
6k views

How to check if URL/ IP belongs to a zeus bot

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?
21
votes
3answers
6k views

Should a hostname ever be considered a secret?

I've been told in the past that you should never give out the host names of computers on your network. I can't think of any reason why this would be the case. Could someone tell me if they should be ...
15
votes
2answers
2k views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...
15
votes
2answers
6k views

How bad is the leaking of Internal IP addresses through external DNS

If an external DNS server is leaking internal IP addresses are there any significant security threats associated with this information leakage? Apart from most the obvious - gaining an understanding ...
10
votes
1answer
5k views

TCP “off-path” Attack (CVE-2016-5696)

Today I read that a flaw in a recent TCP specification leads to the injection of malicious content between the two communicating parties. How does the attack vector work? I have also read a post in ...
10
votes
7answers
3k views

How can I restrict access to network data by an unauthorized computer that connects via Ethernet?

I assume I can configure most routers to only assign IP addresses to specific MAC addresses, as is possible with wireless routers. However what if a computer is connected via Ethernet and does not ...
9
votes
2answers
700 views

How do you Secure VOIP in a large organization

As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help ...
8
votes
1answer
2k views

Is it possible to recognise and prevent MitM attacks on devices which use self-signed SSL certs?

I use both Linux and Windows at work on a large enterprise LAN. The majority of the network configuration is out of my reach. Certain SaaS applications that are hosted locally on the enterprise LAN, ...
8
votes
3answers
6k views

What makes the Blackberry device and network more secure?

One of Blackberry's strongest assets is the "network" that it uses. Can someone explain, or link to technical information that covers what this secure network is, and what it does better than the ...
7
votes
1answer
2k views

Security Operation Center (SOC)

I am looking for resources and details on establishing a security operation center (SoC) or network operation center (NoC) based on ITIL or any other applicable regulations. Where can I find good ...
5
votes
3answers
15k views

How do I diagnose client-side SSL errors?

Often on my home network I get random SSL certificate errors when I visit certain well-known sites. Today it was a Google SSL error, where Google apparently tried to identify itself as *.icloud.com. ...
4
votes
4answers
10k views

Is there an alternative to TCP/IP that encrypts end-to-end?

If there was a communication protocol that encrypts at the very low-level, this would solve the problem of wiretapping entirely and for all.
4
votes
2answers
4k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
3
votes
2answers
4k views

What are the advantages to using a VPN over secured/trusted wifi

It's often recommended that you should use a VPN when using unsecured or untrusted networks, such as open public wifi or secured wifi that you don't control. What are the advantages to using a VPN on ...
24
votes
8answers
9k views

Is possible to get infected by only staying connected to the Internet (nothing else)?

I have a router and I'm the only user. I have a computer with Linux and a tablet with Windows 8.1. Because of a few problems, I had to reinstall Windows on the tablet. Since I'm a bit paranoid about ...
19
votes
4answers
4k views

Detect non HTTP packets using port 80

We are currently doing port whitelisting on our firewalls which is working well but this of course does not prevent the implementation of side channels or the misuse of these ports for other purposes. ...
13
votes
7answers
4k views

Egress filtering on an office network?

With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
12
votes
3answers
751 views

Verifying server software integrity?

I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
12
votes
2answers
16k views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
12
votes
4answers
1k views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks: Is the presence of wireless access points tested for by using a wireless analyzer at ...
11
votes
3answers
13k views

Security measures for a WiFi access point?

I am planning to purchase a program that comes with an App that allows you to control the program via phone. The developer told me that the connection will be done via an extra WIFI box connecting to ...
10
votes
4answers
2k views

Network administrator knowing all user passwords

Whenever it is time to change passwords, each user in our office has to provide our new password to the IT department and they change it & store it. Can you provide something that details why this ...
10
votes
2answers
3k views

How do the root servers get updated with my name server? Is WhoIS information always in sync with the root?

I've never understood what happens behind the scenes when I go to my registrar and enter in my name server's information. Can someone elaborate on what happens when an update is made, and how it is ...
8
votes
6answers
14k views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
8
votes
5answers
1k views

Does the method of Internet connection affect the security of your the network?

I was just visited by some door-to-door salesmen from a local ISP/TV/Phone provider. During our conversation, I raised some concerns about the fact that I knew their help desk techs had back-door ...
8
votes
4answers
23k views

Router Ports open

What ports on my home router should be open, say if I'm only using it for browsing the internet. Right now these four are open, 23/tcp open telnet 53/tcp open domain 80/tcp open http 5000/...
8
votes
5answers
11k views

Does using WPA2-Enterprise just change the attack model vs WPA2-PSK?

As far as I can tell based on the reading I've done so far, WPA2-Enterprise uses the same encryption and security algorithms and methods as WPA2-PSK, with the addition of using another service for ...
7
votes
5answers
5k views

Is it trivial to bypass IP blocking?

There is a site with IP blocking. When a client makes too many invalid attempts when guessing e.g. password, then their IP address becomes blocked. I've heard about IP spoofing and similar attacks. ...
6
votes
2answers
809 views

Is HTTPS redirecting to HTTP a vulnerability?

Let's say a user is authenticated, and the entire account authentication process happened under secure HTTPS. Upon successful login, the user is redirected back to the homepage. However, the homepage ...
5
votes
2answers
617 views

ARP Poisoning: WPA Personal and Enterprise

As mentioned in the title, I've questions regarding an ARP Poisoning on a WPA Personal and WPA Enterprise. I'm gonna do an example (please let me know if I'm wrong): I need to send the ARP reply to ...
5
votes
1answer
844 views

Security implications for two applications communicating with TCP/IP on localhost

Considering this for the local loopback connection: - It is implemented entirely within the operating system's networking software and passes no packets to any network interface controller. If two ...