The Ethical Hacker Network

Latest Additions

Who's Online

deviltaz

Newbie

Offline

Posts: 3

ICMP scan

« on: April 20, 2011, 08:50:00 PM »

Let's say hypothetically, I was connected to a wireless network at a local restaurant/coffee establishment. And the IP address assigned to my device was 10.0.0.20. And hypothetically, I fired up Nmap and ran an ICMP scan against 10.0.0.0/24. The only hosts alive were my device and the AP. Let's say the place was packed, and more than 1/2 the folks had laptops, there should be more than two hosts that would answer a ping, correct? (Let's say most of the folks were connected to the wireless network). Angry IP Scanner produced the same results.

thanks


	Logged

lorddicranius

Sr. Member

Offline

Posts: 447

Re: ICMP scan

« Reply #1 on: April 20, 2011, 08:53:34 PM »

I'm pretty sure that certain WAPs allow you to configure the device so that clients aren't able to see other clients. I believe I read about this in some Cisco WAP documentation, but I'm unable to remember the specific model to quote it.

**EDIT**
Found it: http://www.cisco.com/en/US/docs/wireless/access_point/csbap/wap4410n/administration/guide/WAP4410N_Admin_Guide.pdf

Quote

To prevent wireless computers associated to the same SSID from seeing and transferring files between each other, in the Wireless Isolation (within SSID) field, click Enabled.

You may be experiencing a similar configuration.


« Last Edit: April 20, 2011, 09:23:13 PM by lorddicranius »	Logged

GSEC, eCPPT, Sec+

ziggy_567

Sr. Member

Offline

Posts: 361

Re: ICMP scan

« Reply #2 on: April 20, 2011, 10:51:13 PM »

*Hypothetically*

I'd try another method than ICMP to find hosts nearby. Maybe ARP...maybe NBNS....maybe a TCP SYN scan to TCP/139 or TCP/445.

Or, just fire up Wireshark and see who's broadcasting.


	Logged

--
Ziggy

eCPPT - GSEC - GCIH - GCUX - RHCE - SCSecA - Security+ - Network+

TheXero

Full Member

Offline

Posts: 112

Try Harder!

Re: ICMP scan

« Reply #3 on: April 21, 2011, 03:32:34 AM »

As Ziggy_567 said, do an ARP scan

According to the IPv4 module machines have to respond to ARP requests.

The problem with ICMP is that it can be blocked just like ports whereas ARP should never be blocked inside of a network. ARP can't travel beyond a router but locally should work just fine.

~TheXero


	Logged

OSCP | OSWP
www.thexero.co.uk

deviltaz

Newbie

Offline

Posts: 3

Re: ICMP scan

« Reply #4 on: April 21, 2011, 10:11:18 PM »

Thanks! Appreciate the feedback.


	Logged

lorddicranius

Sr. Member

Offline

Posts: 447

Re: ICMP scan

« Reply #5 on: April 21, 2011, 11:58:12 PM »

Good points ziggy and TheXero. I wonder now, how does that Cisco config work? I wonder how it implements that "wireless isolation."


	Logged

GSEC, eCPPT, Sec+

ajohnson

Recruiters
Hero Member

Offline

Posts: 1057

aka dynamik

Re: ICMP scan

« Reply #6 on: May 07, 2011, 11:37:13 AM »

Quote from: lorddicranius on April 21, 2011, 11:58:12 PM

Good points ziggy and TheXero. I wonder now, how does that Cisco config work? I wonder how it implements that "wireless isolation."

It's analogous to VLANs.


	Logged

WIP: GCFA | www.infosiege.net | @infosiege

The day you stop learning is the day you start becoming obsolete.

lorddicranius

Sr. Member

Offline

Posts: 447

Re: ICMP scan

« Reply #7 on: May 07, 2011, 01:36:39 PM »

Quote from: dynamik on May 07, 2011, 11:37:13 AM

Quote from: lorddicranius on April 21, 2011, 11:58:12 PM

Good points ziggy and TheXero. I wonder now, how does that Cisco config work? I wonder how it implements that "wireless isolation."

It's analogous to VLANs.

I haven't even had time to ponder this thought lol. Thanks dynamik


	Logged

GSEC, eCPPT, Sec+

Pages: [1] Go Up

« previous next »

Exclusive Deal

SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters

5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013

Recent Forum Topics

EH-Net News Feeds

Latest Additions