RE: rogue IP address

From: Burton M. Strauss III (BStrauss_at_acm.org)
Date: 05/02/03

  • Next message: Jose Guevarra: "RE: rogue IP address" 
    To: <security-basics@securityfocus.com>
Date: Thu, 1 May 2003 17:39:54 -0500

    Sometimes, the alert from the LAN management software can be enough - if it
    shows the MAC addresses involved. For example, if it's a D-Link MAC
    address - see the OUI list at the IEEE - and all you have are 3Com NICs,
    well, the hardware probably won't look like any of your other machines
    either and may stand out to a visual audit (that's IT speak for walking
    around being nosy poking you head into cubicles and offices looking for
    hardware you don't recognize).

    Thoughts...

    Program the switch to drop that IP address - see who screams. If the switch
    won't do it for you, you may have to get brutish here - build a transparent
    filtering bridge and drop the packets that way.

    Try using tcpdump to see if you can sniff the packet streams and run
    something like strings on it. It may give you login names etc. that you
    recognize.

    tcpdump -w x.raw -c50
    strings x.raw | grep USER
    strings x.raw | grep PASS (Since people use their mail address for
    anonymous ftp)

    etc.

    (This one is a real PITA, but it works - I've done it successfully) On the
    weekend, unplug each of your backbone switch segments, one at a time and see
    when the rogue drops off the network. Then follow it down to (ultimately) a
    single LAN segment and thence to a specific physical port. Remove said box
    and ransom it back at the cost of an agreement to play nice in the future.

    If you can't do those, here's a sneaky way that sometimes works - build your
    own Linux box and give it that address and MAC address. Put it on the
    network backbone, so everybody sees it as "real close". It should cause
    various routing tables and switches to prefer your box and thus disable the
    rogue. See who screams.

    -----Burton

    -----Original Message-----
    From: dondon@pacbell.net [mailto:dondon@pacbell.net]
    Sent: Wednesday, April 30, 2003 5:40 PM
    To: security-basics@securityfocus.com
    Subject: rogue IP address

    Someone on our network assigned an IP address to their own system without
    my knowledge. Using LANguard network scanner, the best I can tell is that
    it's a Linux box. The port-to-IP mapping table on our Asante switch
    doesn't see to work correctly.

    Any suggestions on tracing down that system that is associated with the IP
    is appreciated!

    Andy

    ---------------------------------------------------------------------------
    FastTrain has your solution for a great CISSP Boot Camp. The industry's most
    recognized corporate security certification track, provides a comprehensive
    prospectus based upon the core principle concepts of security. This ALL INCLUSIVE curriculum utilizes lectures, case studies and true hands-on utilization
    of pertinent security tools. For a limited time you can enter for a chance
    to win one of the latest technological innovations, the SEGWAY HT.
    Log onto http://www.securityfocus.com/FastTrain-security-basics
    ----------------------------------------------------------------------------

  • Next message: Jose Guevarra: "RE: rogue IP address"

    Relevant Pages

    • RE: rogue IP address
      ... Sorry if this seems like a dumb question, but you mentioned a "port to IP" ... Does your switch have a "port to MAC address table"? ... prospectus based upon the core principle concepts of security. ...
      (Security-Basics)
    • Re: how to test Ethernet connection
      ... A switch uses MAC addresses for ascertaining where to forward ... I was not referring to a "MAC Bridge" ... This is more secure as traffic cannot be sniffed by stations on other ports. ... Which just goes to show that 'security' is not a simple quality of which one can have more or less but a set of qualities. ...
      (Debian-User)
    • Re: Man in the middle attack help
      ... EtherFlood floods a switched network with Ethernet frames with random hardware addresses. ... Dsniffs "macof" generates random MAC addresses exhausting the switch's memory. ... It is capable of generating 155,000 MAC entries on a switch per minute. ... Concerned about Web Application Security? ...
      (Pen-Test)
    • Re: Blocking by MAC Address -
      ... So don't tie your security to MAC addresses... ... >> Again an attacker could still bypass 802.1x with this configuration. ... >> Switch will only see one MAC. ...
      (microsoft.public.windows.server.networking)
    • RE: Exploit code for IP Smart Spoofing
      ... If there is a MAC violation, this is logged and the port is ... traffic of one other host on the switch. ... but there is no way to protect against ...
      (Bugtraq)