Please enable JavaScript.

Coggle requires JavaScript to display documents.

Network Device Security, Two Addresses :check: - Coggle Diagram

- - - - connects two physical segments of a network
    - - Connects networks together
      - determines the path a packet will take over a network
      - interconnect logical networks
      - looking at IP addresses when forwarding packets.
      - drops traffic if it does not
        know where to send it.
    - - Replicates traffic onto all ports, minimal security
      - does not have traffic monitoring capabilities
        
        Send data frame to Broadcast
      - have no routing tables or intelligence
      - It is trivial to sniff
        
        because all systems connected to the hub receive all information
    - - as a controller
      - enabling networked devices to talk to each other efficiently.
      - Micro-segmentation with each port receiving traffic for the appropriate host using the MAC address
      - combines the functionality of a hub and a bridge
      - can retransmit data to multiple ports.
      - difficult to sniff
        
        because the switch stores the MAC address and only-sends to that address
  - - - is a program and/ or device that monitors data traveling over a network
        
        on hub it's easy to sniff
        
        it send packet to broadcast
        
        Switch need to impersonating a local
        router
        
        Tools,
        
        dsniff and Ettercap, facilitate sniffing
      - notes
        
        An Ethernet packet(frame): contains in its header SMAC,DMAC
        
        The Ethernet switch is more intelligent than the hub
      - explained in book :green_cross:
    - - tools
        
        Wireshark
        
        detailed analysis and packet decoding
        
        Snort
        
        NIDS to determine scope of compromise
        
        Dsniff
        
        useful for sniffing on a switch
        
        Kismet
        
        wireless network sniffer and intrusion detection system
        
        Tcpdump
        
        initial triage
      - notes
        
        Sniffers provide visibility into what is happening on a network
        
        which is useful for both troubleshooting problems and analyzing security issues
        
        sniffer can be hardware physically connected or software run on networked computer
    - - dsniff
        
        The attacker's system sends out a forged ARP packet to the target system
        
        telling it that its default gateway has changed to the attacker's system
        
        When the target system sends traffic on the network, it sends it to the attacker's system first
        
        which then forwards the packet on to its original destination as if nothing ever happened
      - Ettercap
        
        relies heavily on ARP cache poisoning
        
        (where the attacker sends false ARP replies to associate his MAC address
        
        to the IP addresses of both the source and the target hosts
  - - - host looking for the
        MAC address of
        
        another host on the LAN
        
        the default gateway
      - router looking for the MAC address of a host or another router on a LAN.
- - - - Directed Broadcasts
        
        are seldom needed with modern protocols
        
        helps you implement remote administration tasks.
        
        works is by flooding the target subnet with broadcast packets
        
        but without broadcasting to the entire network
        
        BOOK
      - IOS ports and services
        
        The IOS has services and open ports running
        
        Open ports with a visible IP address become an avenue of attack
        
        only allows for the device to perform its functionality
        
        often allows remote access
        
        Routers are devices and have an operating system called an IOS
        
        for devices to communicate over a network
        
        they need to have an IP address and open ports.
        
        Default installation focused more on functionality than security
      - Telnet vs SSH
        
        Telnet
        
        Telnet is typically used for remote access of routers
        
        Telnet is susceptible to sniffing because everything, including passwords is sent in plaintext
        
        SSH
        
        is a preferred alternative
        
        helps with password sniffer, but not with password guessing unless certificates or preset keys are used
      - SSH via internal port
        
        BOOK
      - Latest IOS
      - Source Routing
        
        Allows IP packets to specify routing
        
        in formation in an IP header that lets the source host dictate the path the packet uses to get to
        its destination
        
        used to bypass firewalls and other protective devices
        
        used by attackers
        
        Should be disabled by default
        
        ex in the real world
        
        When the thief creates the path the police avoids until he reaches what he wants
    - - VLAN's
        
        Allows segmentation of a switch into different networks
        
        Creates separate networks through software, not hardware
        
        Reduces the visibility and potential damage from an attack
      - Network Access Control (NAC)
        
        Dynamic VLAN allocation
        
        Enables systems to be scanned and checked prior to being put on a trusted segment
        
        Isolated systems when they initially connect to the network
        
        allows systems to be placed on isolated VLANs until they have been scanned and properly patched
      - 802.1 x
        
        Network-level authentication
        
        Only allow authorized devices to connect
        
        Limits and controls the connection of rogue devices
        
        Can be used with both wired and wireless devices
      - Port Forwarding
- - - - Determines the next hop
        
        uniquely allocated to each (NIC)
        
        burned into NICs during the manufacturing process.
      - ex: 00-00-0c-34- I7-a3
        
        First half vendor code ( 00:00:oc - Cisco)
        
        the second half of the address is a unique number assigned by the vendor
- - - - actual network to which the host is attached
    - - usually written in dotted-decimal format
        
        the first part is (NET_ID)
        
        second part is (HOST ID
        
        ex : I0.5.10.37