RE: Network "Change Management"

From: Evan Pierce (evan_at_pierce.co.za)
Date: 09/16/04

  • Next message: okeeffe_at_xecu.net: "Re: Network "Change Management""
    To: "'Dave  Torre'" <dtorre@fostercity.org>, <focus-linux@securityfocus.com>
    Date: Thu, 16 Sep 2004 23:15:23 +0200
    
    

    Dave

    Why not rather restrict DHCP to an allowed list of MAC addresses? And lock a
    specific port onto a specific MAC address or if you have too many users that
    are mobile (plug into many different ports) use EAP or 802.1x authentication
    from the switch to a Radius server and block things that way. Most modern
    switches will allow this.

    Thanks
    Evan

    -----Original Message-----
    From: Dave Torre [mailto:dtorre@fostercity.org]
    Sent: 14 September 2004 07:53 PM
    To: focus-linux@securityfocus.com
    Subject: Network "Change Management"

    Does anyone know of a Linux utility that can watch the MAC address tables in
    Cisco switches and alert admins as to when a new device has been plugged in?

    Basically, we have your standard client network with DHCP. Internet access
    is restricted to authenticated users, and so are the file shares.
    However, we've had a few instances where people just plug in their personal
    laptops which makes me very worried...

    Any thoughts/suggestions as to how I can monitor such events in real time?

    Thanks,
    -Dave


  • Next message: okeeffe_at_xecu.net: "Re: Network "Change Management""

    Relevant Pages

    • Re: Static IP outside of router DHCP range
      ... Unfortunately my 8 clients are little $50 boxes with an Ethernet port and yellow, red, and white outputs for composite NTSC video and stereo audio, but no provisions whatsoever to flash their NVRAM. ... So I have no way to either reserve IP addresses based on Mac addresses, nor do I have a way to set them up as static. ... I still am wondering if my Netgear switches truly have any "memory" of the ports associated with specific IP addresses of the connected clients, as they have no reset or reboot function as far as I know. ...
      (alt.comp.hardware.pc-homebuilt)
    • Re: ROGUE APs at Work - How to locate them?!
      ... If you have the MAC address and you have ethernet switches that are smart ... MAC address, then you lookup that MAc address on the switches until you find ... the hardware port. ... network card in the PC could unplug the computer, ...
      (alt.internet.wireless)
    • Re: How to block a client from DHCP?
      ... server, and compliant operating systems. ... Another option is to use switches that can protect the network based on mac ... My HP2512 switch also can do port isolation ...
      (microsoft.public.windows.server.networking)
    • Re: Network scanning
      ... HP managed switches have this feature too, as a bonus you can also specify ... simultanious MACs on a port, or specify which addresses are allowed. ... Subject: Network scanning ... Most newer switches can lock down how many mac addresses are allowed to ...
      (Security-Basics)
    • Re: Seeing unexpected skinny heartbeats when sniffing IP phones network traffic
      ... :supposedly a normal occurance when the switches MAC table gets filled ... :its table, it sends it out all its ports; not as a broadcast packet, ... :but essentially a broadcast because it is sent out every port. ...
      (comp.dcom.sys.cisco)