Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [network]

Security of network infrastructure and network traffic. For questions about security of network equipment, topology, protocols, traffic, administration, and configuration. Related tags: [packet], [firewall], [network-scanners], [network-access-control].

Filter by
Sorted by
Tagged with
1
vote
1answer
761 views

Default or Guessable SNMP community names: public

We have detected "Default or Guessable SNMP community names: public" vulnerability in one of our printer through Nexpose. The remediation states we have to secure SNMP installation. What does it mean ...
0
votes
1answer
117 views

Could an Smart TV be a threat for a hotel?

After some research I found that a Smart TV which is connected on the Internet could be vulnerable to threats such as monitoring, taking control of the tv etc. I wonder if a Smart TV which is used by ...
2
votes
2answers
106 views

What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network

What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
1
vote
1answer
56 views

NAS with a public IP and multiple file sharing services – security concerns

I've ‘inherited’ (it's now my responsibility to take care of it) a WD My Cloud EX2 with a public IP and since it's exposed to the internet, I want to make sure that the data and other machines on the ...
0
votes
0answers
51 views

Detecting network attacks by processing individual or multiple network packets?

I am trying to create a tool that identifies network attacks using machine learning, something like a small intrusion detection system. I have collected benign traffic from the network and then ...
5
votes
1answer
77 views

Can I use `lsof` to reliably determine which local process has connected to my open port?

Say I'm running a server application on 127.0.0.1:7646 and a local process (possibly owned by a different user) connects to it, I can run lsof -Fp -i TCP@127.0.0.1:7646 -i TCP@127.0.0.1:<...
3
votes
3answers
263 views

Should I block IP adresses that made attacks attempts and were block from an IPS through the rules?

We have an NIPS blocking attacks based on bad behaviors (rules checking the data in the network packets). Should I block the IP that the NIPS linked to attack attempts? It feels like the NIPS is ...
3
votes
1answer
118 views

AWS Flowlog for Private Subnet Showing Routable IP's

When reviewing Flowlogs for a host on a private subnet in an AWS VPC that routable IP addresses are being rejected. How is that possible? I expect IP addresses from the private subnet could be ...
3
votes
1answer
94 views

SOX Compliance - Is Running EOL Equipment Considered a Violation?

Let's say I have some networking equipment that will no longer receive vulnerability patches after 2019. This equipment makes up the spine of the company infrastructure. Let's say it's definitely ...
4
votes
1answer
248 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
2
votes
0answers
93 views

Decrypting DH traffic in DMZ

We have various servers in our DMZ's. Some of them are behind load balancers (but only few). We also have BlueCoat SSL Visibility Appliances currently deployed in passive-tap mode (we get the inbound ...
1
vote
0answers
87 views

Monitoring and Securing IoT devices [closed]

I have a mix of IoT devices at home. Alexas, WiFi PLugs, Smartthings (with related Z-Wave/Zigbee devices). I've been on the hunt for a solution to monitor what these devices send out and secure data ...
1
vote
1answer
383 views

NMAP reporting all ports open

I'm trying to scan my targets for open ports. However, NMAP reports all of them as 'open'. I know there's a firewall in between. I tried the SYN scan, and when I check the traffic in WireShark I see ...
0
votes
3answers
148 views

Can information sent over unencrypted http still be seen if I'm on an encrypted wifi?

I was booking a haircut online and noticed that when they made me sign up for an account, the credentials were not being encrypted (or at least that's what firefox was telling me). It's not a huge ...
0
votes
1answer
39 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
0
votes
1answer
311 views

Visibility of network traffic in Teamviewer

I intend to use public wifi to access my home computer from the local library. I was wondering if I remote login to my home computer using Teamviewer on a compromised wifi, will a hacker be able to ...
1
vote
0answers
32 views

What is the subset that represents well a netflow dataset? [closed]

I want to analyze a Netflow dataset by using a sliding window, therefore, I would like to know what should be taken into consideration when splitting the data? The parameter that I am considering is ...
2
votes
2answers
45 views

Secure authorization for subscription-based games or services

Let's suppose I'm developing a subscription-based desktop game: the player pays a fee in order to get access to certain levels of the game for a certain time. For example, the player pays $1 to get ...
1
vote
1answer
1k views

Where exactly in the OSI model does TLS/SSL belong [duplicate]

I am trying to understand where exactly SSL/TLS sits in OSI model. If I look at this answer on StackExchange, While all network models are imperfect, this question can only be answered by looking ...
-1
votes
1answer
43 views

Infection of malware

Lets say, My firewall is configured to block any incoming connections My browser doesnt allow any traces and scripts I have vpn on My browser always asks before downloading files My browser doesn't ...
0
votes
3answers
441 views

Encryption of TCP communication?

I am using an exe application which is communicating with a Raspberry Pi device with manually configured TCP ports. The application will send data from port 1234 to the Raspberry Pi which is listening ...
1
vote
1answer
304 views

OpenVPN one account multiple servers & Load Balancing

I have recently been experimenting with OpenVPN. My aim is to create a group of servers in different locations with a single username and password for each user stored in a central database. For ...
1
vote
1answer
687 views

How to pass a localhost check for an incoming request?

I'm trying to send a request to an http server hosted on a machine. The http server is in C# and drops any packets that are not from localhost: public void Request(HttpListenerContext context) { ...
0
votes
1answer
237 views

Authenticating Certificate for School Wifi [duplicate]

My school wifi, which requires me to login using ny username and password, is requiring that I accept a certificate in order to connect. I don’t know if this is a trusted root certification but what ...
1
vote
0answers
45 views

What are the most important security controls to implement when deploying BYOD in an organization? [closed]

In organizations like banks that have already many security controls. Will implementing BYOD (our organization employees will be able to use their own computers to access the organization when they ...
0
votes
1answer
133 views

Is my network infected? Suspicious messages and devices slowing down

Recently a family friend has been complaining that he has been getting hacked on his home network and that he has been receiving suspicious messages from the attacker. He says that the attacker has ...
0
votes
1answer
697 views

IDS and IPS placement in network? [duplicate]

What is the good practice for the placement of IDS (NIDS) and IPS? Before the firewall or after the firewall? and why?
8
votes
6answers
1k views

What are the techniques to detect malware call home/beaconing activities?

It is very common for active malware to "call home" (or beaconing), either to fetch updates and instructions or to send back stolen information.. In an internal network where web access to the ...
-4
votes
1answer
110 views

Can code be transmitted through computers’ antennas? [closed]

I have an Acer Aspire E15 5-575. I removed its WiFi card, while kept its black and white antennas intact. I did this to avoid being discovered by long or short range wireless transmissions, wanting to ...
1
vote
3answers
696 views

How to detect when one or more devices in my local network have become DDOS attack nodes?

I have a home network, big family, with around 20 devices on it at any given time. It seems like every year or so, some device gets a virus or a security flaw is revealed, and the device starts ...
0
votes
1answer
55 views

Block external http calls

I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code ...
1
vote
2answers
185 views

How dangerous is this Network?

Our school requires everyone to bring their own laptops for homework, etc. It uses something called 'Genian NAC' to authenticate users. I can either use Ethernet or Wi-Fi to connect, but both require ...
1
vote
1answer
114 views

PC Isolation on network

I believe I have my answer but I just want to be sure. Basically I repair computers, most of unknown origins. Of course some could have viruses and such so I was wondering what the most efficient way ...
2
votes
3answers
158 views

How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily?

Threat: your Linux machine gets compromised in some way (untrusted app, or compromised install package or update, or an app is compromised because of a vulnerability, etc.) and something on your ...
0
votes
2answers
114 views

Can a static IP address be a trusted user identifier in a secure environment?

Would it be an acceptable practice, if we were to register a client (individual or company) by associating them with their static IP address to perform some secure action that only authorized clients ...
0
votes
2answers
108 views

Have firewall and VPN already, should I buy a mini router to protect my laptop?

I often travel for business and use hotel wifi. I have installed Little Snitch and VPN-Outline for internet security. Should I buy a mini router? Will it keep my computer safer? Otherwise,with or ...
0
votes
3answers
2k views

In ARP spoofing is it two MAC mapping to one IP address OR two IP mapping to one MAC address?

In ARP spoofing, is it two MACs mapping to one IP address OR two IPs mapping to one MAC address? As far as I understand, it should be two MACs mapping to one IP. But I came across this question which ...
2
votes
1answer
92 views

What attacks can a subnet gateway perform on the subnet?

What attacks can a subnet gateway perform on the subnet? For example, my ip4 address is 192.168.116.34 and the gateway is 192.168.116.111. What are the threats I am exposed to from a person sitting ...
2
votes
3answers
114 views

Can a malicious computer on a link local network cause harm on another network?

If I had a firewall with two interfaces - one to an internal private network and the other on a link local network (169.254.0.0) - and sent all questionable requests to the link local computer, could ...
5
votes
0answers
195 views

How to send Wi-Fi management frames from macOS?

I realise that this question has been touched on before as linked here. However, none of the solutions suggested solved my question and it fails to answer the overarching question of how to send all ...
2
votes
1answer
362 views

Nmap --script-args usage?

I'm trying to use multiple Nmap --script-args at the same time. $ nmap -vv -p80,443 --script http-errors --script-args "httpspider.url=/,httpspider.maxpagecount=3,httpspider.maxdepth=1" website.com ...
-1
votes
1answer
844 views

Bypassing blacklisted MAC address filtering (that prevents certain MAC address to access router)

PROBLEM OVERVIEW I have a access to a large WLAN network (in a hostel); where lot of students have access to wifi password. So, to prevent sharing this password to others I used MAC address white-list ...
0
votes
1answer
114 views

How is my employer accessing my router when employer's laptop is wirelessly connected to my home network

I have a modem bridged to a modern router running open source software and heavily secured. I have all connections to the router through a personal vpn from a dedicated provider. During work from home ...
1
vote
1answer
445 views

Unable to establish shell with ncat over SSL

I am attempting to get a shell open between a Linux and Windows machine. On the Windows machine, I run: ncat --exec cmd.exe -vnl 4444 --ssl Once it is listening, I run the following command on my ...
3
votes
4answers
153 views

Asymmetric Encryption

I understand Asymmetric Encryption works by having the private key known only to your computer, while the public key is given by your computer to any computer that wants to communicate securely with ...
1
vote
2answers
233 views

How to find and ban some devices from my wifi using the command line? [closed]

I use Arch Linux. I just installed some packages such as nmap, netdiscover and others. It is a ubiquiti internet network, for the sharing of connection to several routers. There are about 7 routers ...
3
votes
2answers
274 views

How to prevent exam cheating in computer labs using remote access software

My home country trying to crack down on corruption in government job examination cheating. However, some party was able to bribe the lab that conducted the exam and put remote access software into the ...
0
votes
1answer
792 views

Is it advisable to accept STUN server connections?

My firewall reports outgoing connection attempts via com.apple.WebKit.Networking to a number of STUN servers (namely, stun.nas.net, stun.node4.co.uk, stun.voxox.com and stun.wwdl.net). This is ...
-2
votes
1answer
268 views

What is the difference between DNS flood attack and UDP flood attack?

As title says, what is the difference between DNS flood attack and UDP flood attack? Plus, do they only exhaust the network bandwidth or do they also exhaust the server-side assets such as CPU, ...
1
vote
1answer
71 views

How does Software Defined Perimeter (SDP) protect against certains attack that happen in the browser?

I have been doing a bit of research on SDP (Software Defined Perimeter) but it's still a bit unclear to me how it protects against certain types of attacks. On Wikipedia it says that it can protect ...