2KKUU7ita

Chapter 8: Network Infrastructure
NetResident also has the capability to perform ARP poisoning, which
allows NetResident to see everything on the local network segment. I cover
ARP poisoning in the section “The MAC-daddy attack,” later in this chapter.
Countermeasures against network protocol vulnerabilities
A network analyzer can be used for good or evil. The good is to help ensure
your security policies are being followed. The evil is when someone uses
a network analyzer against you. A few countermeasures can help prevent
someone from using an unauthorized network analyzer, although there’s no
way to prevent it completely.
If an external attacker or malicious user can connect to your network (physically
or wirelessly), he can capture packets on the network, even if you’re
using an Ethernet switch.
Physical security
Ensure that adequate physical security is in place to prevent someone from
plugging into your network:
✓ Keep the bad guys out of your server room and wiring closet.
Ensure that the web, telnet, and SSH management interfaces on your
Ethernet switches are especially secure to keep someone from changing
the switch port configuration and seeing everything going across the wire.
✓ Make sure that unsupervised areas, such as an unoccupied lobby or
training room, don’t have live network connections.
For details about physical security, see Chapter 6.
Network analyzer detection
You can use a network- or host-based utility to determine whether someone
is running an unauthorized network analyzer on your network:
✓ Sniffdet (http://sniffdet.sourceforge.net) for UNIX-based
systems
✓ PromiscDetect (http://ntsecurity.nu/toolbox/promiscdetect)
for Windows
Certain IPSs can also detect whether a network analyzer is running on your
network. These tools enable you to monitor the network for Ethernet cards
that are running in promiscuous mode. You simply load the programs on
your computer, and the programs alert you if they see promiscuous behaviors
on the network (Sniffdet) or local system (PromiscDetect).
145