Guarding against Spoofed/Decoy IP (Nmap)

Hi

I'm a student aiding the school's Network Administrator in carrying out unpaid pen-testings (since i'm uncertified) and this is a good chance for me to do the practical aspects of penetrations/network. Been doing research for roughly 2months and i've gained quite abit of insights through reading, private studying and testings internally.

Just a simple question, This is a Nmap (Decoy) Question and maybe Snort in mind.

I've been reading through how Cisco Routers have NetFlow and CEF to defend against Spoofed IP. Don't really know its effectiveness since we don't know the mechanism of NetFlow or CEF.

I've come across articles mentioning that the only way to trace back is to go to the lower layers to discover the attackers IP/MAC. I was wondering are there any tools online to complement/allow network administrators to look for the MAC Address which packets are originating from the network i'm performing the scan on?


Thanks

Hm, from what I gather, not sure if I am reading you correctly. It sounds to me as if you could use ethereal with port mirroring on your 'main' switch/router and set up filters to pull/extract the mac addys from raw streams. An easy well documented task to tell you the truth.

Check out ethereal, it will give you the macs you are seeking. www.ethereal.com

Okay.

But ethereal does not work on typical corporate network architectures. Please correct me if i'm wrong, Ethereal sniffs data when incoming or outgoing data is running. But in a switch environment ethereal definitely don't run well.

and certainly not going to install ethereal on every single dmz servers. :confused:

You're wrong. See spanning ports on Cisco switches, also known as mirroring on other manufacturer's gear. This is standard practice for sniffing traffic on a switched segment. Going a step farther, if you hook up ethereal at an upstream router/switch, you'll see more traffic than you'll know what to do with.


PS

Idle scanning is not perfect when it comes to hiding. See my NMAP tutorials on this site.

--Th13

ethereal is mentioned, I assume, because it is easier for the less technical to employ. I'm not saying you're not technical, I'm saying snort is a bitch and her ugly stepsister to work with if you don't know anything about it. Ethereal is relatively painless to setup and get running scarecely a clue.

Th13's statement is 100%. This is standard operating procedure at most org's that monitor traffic in the DMZ and/or through their externally facing devices. (And if you work for a company that has a firewall/dmz and DOESN'T monitor traffic, please let me know. We'll be on site with our sales rep in a day or two!) One port is spanned (mirrored) to basically copy all traffic to/from all interfaces on the switch to it also. You plug your sniffer (thus the name 'snort') into this port, and start storing data. A LOT of data, usually.

You can also pay a lot of money for a ridiculous little device called a SINC (Sync? Sink?) Basically, its a tiny hub that you plug in betweek an upstream line and the wan port, and it pushes alll traffic to a second port for a sniffer to record. It's esentially a small hub, with a few differences.

thehorse13 is right, just try it on your gateway and you will catch more traffic than you know what to do with. Very system intensive if you are realtime.

You do need to take advantage of the port mirroring feature though. Plus if you are on a gateway it matters not that you have 60000 switches below, all that traffic has to hit the gateway. Well all outbound traffic. And if that is the case then setup your 'sniffer' consoles at the 'smart' switches (mirror that too).

I know this works fairly well because I have implemented it as a consultant. Not the whole sight picture in itself but a large portion. Not sure about the team of people you will need to 'sift' through the packets, but then again, if you set up the ethereal filters to suit your needs you shouldn't have to.

in refrence to zencoders about the hub, does anybody know of any, im pretty interested in that sounds pretty kool. ethereal has a easy setup, ive also used cain, has a sniffer build in, just google it.

The network infra has actually packeteer packetshaper running on the external interface monitoring packets running through.

In this thread, I'm pretty much concern about the circumstances running Nmap during Pen-Testing. Are there dedicated equipments to look after legit IPs running inside the internal network and fend off the bogon spoofs?

Yes. It's called an IDS/IPS.


ISS makes a commercial version. Snort makes an open source version and the list goes on from there. These are the two I commonly use. If you are broke, you can use poor man's ACLs on switches and routers to try to accomplish this, that is, if your gear is capable, however, the results will not be nearly as nice as a dedicated IDS/IPS solution.

OFF TOPIC:
i am not very much into the topic u are talking but i do have one tool which i think will do the job for you
try out
NETCAT or CRYPT CAT
these tools also can spoof ip's (read in a magzine,nvr used them)
i hope it was help ful