The Ethical Hacker Network - Monitoring for new machines on the network

sargule

Newbie

Offline

Posts: 8

Monitoring for new machines on the network

« on: February 02, 2008, 05:38:29 PM »

We have scripts that detect new clients on the network by monitoring DHCP logs for new IP registrations within minutes of the machine getting an IP address. However it is not possible to identify the switch port the machine was connected to. There are about 100 switches and about 25 segments across multiple floors. Has anyone encountered this situation?


	Logged

slimjim100

EH-Net Columnist
Sr. Member

Offline

Posts: 385

Re: Monitoring for new machines on the network

« Reply #1 on: February 02, 2008, 06:43:11 PM »

Do your Switches support SNMP?

Brian


	Logged

CISSP, CCSE, CCNA, CCAI, Network+, Security+, JNCIA, & MCP

sargule

Newbie

Offline

Posts: 8

Re: Monitoring for new machines on the network

« Reply #2 on: February 02, 2008, 09:09:18 PM »

Yes, they support SNMP. Is there someway for a switch to periodically dump its CAM table. That would give information about MAC and ports.


	Logged

slimjim100

EH-Net Columnist
Sr. Member

Offline

Posts: 385

Re: Monitoring for new machines on the network

« Reply #3 on: February 02, 2008, 10:49:50 PM »

You will need to MIB walk the switch to see what it supports but you should be able to have it broadcast the port and switch name with every active connection. Rhis look to the time stamp and compare it too the IDS or program you have that tells you a new client is online.

Brian


	Logged

CISSP, CCSE, CCNA, CCAI, Network+, Security+, JNCIA, & MCP

federal

Newbie

Offline

Posts: 1

Re: Monitoring for new machines on the network

« Reply #4 on: February 03, 2008, 04:14:59 PM »

Can you identify the new member by the ISP?
Name/Location/Telephone?


	Logged

slimjim100

EH-Net Columnist
Sr. Member

Offline

Posts: 385

Re: Monitoring for new machines on the network

« Reply #5 on: February 03, 2008, 08:27:31 PM »

federal,

We are talking about local LAN switches and I am nit sure what you are trying to ask because the ISP would be at the gateway of the network and would be your networks ISP...

What are you trying to ask here?

Brian


	Logged

CISSP, CCSE, CCNA, CCAI, Network+, Security+, JNCIA, & MCP

slimjim100

EH-Net Columnist
Sr. Member

Offline

Posts: 385

Re: Monitoring for new machines on the network

« Reply #6 on: February 03, 2008, 09:03:52 PM »

Other ideas on managing your switched network is to enable layer2 security features on the switch if it supports it. This could help with Man in The Middle Attacks, spoofing, & VLAN jacking. You could use VLANs by switch, floor, port, or any other idea you may have. The power of VLAN's is often over looked on the switches if they support it. As for SNMP you could code out a program to send mibs to your switches to show you port status and details on connection. If you comment on the ports with the details like room numbers for ports or other helpful details on where the other end of the port is the SNMP could send this detail when someone plugs in so you know when and where the connection is made. Let me know if you have questions.

Brian


« Last Edit: February 03, 2008, 09:05:59 PM by slimjim100 »	Logged

CISSP, CCSE, CCNA, CCAI, Network+, Security+, JNCIA, & MCP

g00d_4sh

Sr. Member

Offline

Posts: 394

Re: Monitoring for new machines on the network

« Reply #7 on: February 04, 2008, 10:33:15 AM »

We have some VLANs set up at my work, and I"m pondering doing a port security implimentation as well. Honestly I don't know enough about the snmp for answering the original question of the post, but I'm assuming Slimjim's answers are good.


	Logged

"Bad.. Good? I'm the guy with the gun"

slimjim100

EH-Net Columnist
Sr. Member

Offline

Posts: 385

Re: Monitoring for new machines on the network

« Reply #8 on: February 04, 2008, 10:55:33 AM »

SNMP with MIBs can let you control or poll anything from a device that supports SNMP. You will need to get the vendors MIB/SNMP tables and then with a little PHP and some scripts you could do anything you need to your network. 90% of the vendors tools out there are sending SNMP traps and MIBS to configure the devices. Like Cisco's config maker is using SNMP and Http to talk to the devices and make config settings.

Brian


	Logged

CISSP, CCSE, CCNA, CCAI, Network+, Security+, JNCIA, & MCP

sargule

Newbie

Offline

Posts: 8

Re: Monitoring for new machines on the network

« Reply #9 on: February 04, 2008, 12:39:29 PM »

Thanks Slimjim,
The network is managed by a separate group. There are scripts out there that help do so, but from what I have seen, it needs good amount of scripting.
For now, they have agreed to implement port security on open ports that will let us know if something was connected to those ports. (Not necessarily MAC/IP info, but just an indication that the port came up or went down). We would then use it with our DHCP log alerts to identify the location. Lets see how it goes. Thanks for all the inputs.


	Logged

dean

Guest

Re: Monitoring for new machines on the network

« Reply #10 on: February 04, 2008, 08:03:03 PM »

sargule,

If you've manged to get your network group to enable SNMP LINK UP/DOWN traps either globally or on a per port basis then see if you can get them to enable MAC-NOTIFICATION-TRAPS as well (Cisco-centric command, not sure of equiv on other switches). This will let you know the MAC Address of a device connecting to that port.

Have a look at netdisco. You can use it to locate the port that the user/device is on by IP or MAC.

www.netdisco.org

dean


	Logged

Pages: [1] Go Up

« previous next »