2KKUU7ita

Figure 8-3:
NetScan-
Tools Pro
OS Fingerprinting
tool.
Chapter 8: Network Infrastructure
Configure firewalls to look for potentially malicious behavior over time (such
as the number of packets received in a certain period of time) and have rules
in place to cut off attacks if a certain threshold is reached, such as 10 port
scans in one minute or 100 consecutive ping (ICMP) requests.
Most firewalls and IPSs can detect such scanning and cut it off in real time.
You can break applications on your network when restricting network traffic,
so make sure that you analyze what’s going on and understand how applications
and protocols are working before you disable any type of network traffic.
Scanning SNMP
Simple Network Management Protocol (SNMP) is built in to virtually every
network device. Network management programs (such as HP OpenView and
LANDesk) use SNMP for remote network host management. Unfortunately,
SNMP also presents security vulnerabilities.
Vulnerabilities
The problem is that most network hosts run SNMP enabled with the default
read/write community strings of public/private. The majority of network
devices I come across have SNMP enabled and don’t even need it.
133