Date: Sun, 14 Jan 2001 00:11:14 -0800 (PST) From: opentrax@email.com To: wes@softweyr.com Cc: sthaug@nethelp.no, matrix@ipform.ru, questions@FreeBSD.ORG, security@FreeBSD.ORG Subject: Re: Building a local network on switches (ANTISNIFFER measures) Message-ID: <200101140811.AAA00707@spammie.svbug.com> In-Reply-To: <3A56AD06.BDD770B0@softweyr.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 5 Jan, Wes Peters wrote: > sthaug@nethelp.no wrote: >> >> > Somebody said, that there is way to fool but floodding it with weird >> > arpa entries and the switch will fall back into hub mode. I wonder if it >> > is true for all hubs and if I can use non SNMP controllable hub. >> >> Think about how a hub works (or for that matter a switch). It has a >> MAC address table of a certain finite size. If you send packets with >> a MAC address which is not in the address table, the packet must be >> transmitted on all ports (except the one it arrived on). > > Except some managed switches allow you to specify certain MAC addresses > that are allowed on a given port. Packets received from other MAC > addresses are dropped. > Yes, 3Com ethernet ethernet switched hubs offer this. However, most admins I've run into kill that feature. One co-lo we were in started dropping packets for no reason. So ourselves and others would ping the outside world just to keep our servers from getting dropped. Yes, they were 3Com. Getting back to the question about ANTI-sniffer measuers. Good hackers usually go for the weakest link. If SNMP routers and hubs have passwords and don't get set to 'public', they will go after other boxes. I suggest if you are running a co-lo or something with many servers, sett up a sacrafical lamb. A 486-box with minimal setting is good, maybe even with jail. If you give then an easy target, they will usually go for it. In other words, make it a target. Jessem. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200101140811.AAA00707>