RE: Network "Change Management"

From: Jose Hidalgo Herrera (jose_at_hostarica.com)
Date: 09/17/04

  • Next message: Ben Nelson: "Re: Network "Change Management"" 
    To: Evan Pierce <evan@pierce.co.za>
Date: Fri, 17 Sep 2004 10:19:44 -0600

    You can restrict DHCP to an allowed list of MAC addresses, but what
    about the laptops using random IP addresses?, you can know that is the
    gateway or DNS just sniffing the network, getting broadcast packages.

    Even if you restrict your DHCP to an allowed list of MACs you will need
    to monitor the activity, I recommend using arpwatch on the
    gateway/firewall, and restrict as much as posible on your firewall.

    On Thu, 2004-09-16 at 15:15, Evan Pierce wrote:
    > Dave
    >
    > Why not rather restrict DHCP to an allowed list of MAC addresses? And lock a
    > specific port onto a specific MAC address or if you have too many users that
    > are mobile (plug into many different ports) use EAP or 802.1x authentication
    > from the switch to a Radius server and block things that way. Most modern
    > switches will allow this.
    >
    > Thanks
    > Evan
    >
    > -----Original Message-----
    > From: Dave Torre [mailto:dtorre@fostercity.org]
    > Sent: 14 September 2004 07:53 PM
    > To: focus-linux@securityfocus.com
    > Subject: Network "Change Management"
    >
    > Does anyone know of a Linux utility that can watch the MAC address tables in
    > Cisco switches and alert admins as to when a new device has been plugged in?
    >
    > Basically, we have your standard client network with DHCP. Internet access
    > is restricted to authenticated users, and so are the file shares.
    > However, we've had a few instances where people just plug in their personal
    > laptops which makes me very worried...
    >
    > Any thoughts/suggestions as to how I can monitor such events in real time?
    >
    > Thanks,
    > -Dave 

    --
Jose Hidalgo
PGP: 15524480
jose at hostarica.com
http://www.hostarica.com
  • Next message: Ben Nelson: "Re: Network "Change Management""

    Relevant Pages

    • Re: Cant Access ANY url from python (errno 61)
      ... my mac's MAC address is different from the MAC address shown ... wireless router at his apartment. ... restrict -6 default kod nomodify notrap nopeer noquery ...
      (comp.lang.python)
    • Re: Cant Access ANY url from python (errno 61)
      ... my mac's MAC address is different from the MAC address shown ... wireless router at his apartment. ... restrict -6 default kod nomodify notrap nopeer noquery ...
      (comp.lang.python)
    • RE: Network "Change Management"
      ... Why not rather restrict DHCP to an allowed list of MAC addresses? ... specific port onto a specific MAC address or if you have too many users that ... Cisco switches and alert admins as to when a new device has been plugged in? ...
      (Focus-Linux)
    • Re: DHCP security
      ... is there some way to restrict traffic to only those assigned IPs ... (through DHCP) ... You can usually arrange to restrict machine that connect to only those with ... around by someone clever they would need to spoof the known MAC address of one ...
      (Fedora)
    • Re: Restrict DHCP address to domain computers ONLY???
      ... You may be able to configure your switch to lock each port ... to a specific MAC, in turn this would restrict a new machine from plugging ... > assignment somehow be restricted to MAC address (maybe through group ...
      (microsoft.public.windows.server.general)