.

Monitoring for new machines on the network

<<

sargule

Newbie
Newbie

Posts: 8

Joined: Tue Jan 01, 2008 11:59 am

Post Sat Feb 02, 2008 6:38 pm

Monitoring for new machines on the network

We have scripts that detect new clients on the network by monitoring DHCP logs for new IP registrations within minutes of the machine getting an IP address. However it is not possible to identify the switch port the machine was connected to. There are about 100 switches and about 25 segments across multiple floors. Has anyone encountered this situation?
<<

slimjim100

User avatar

EH-Net Columnist
EH-Net Columnist

Posts: 385

Joined: Wed Nov 08, 2006 12:50 pm

Location: Atlanta

Post Sat Feb 02, 2008 7:43 pm

Re: Monitoring for new machines on the network

Do your Switches support SNMP?

Brian
CISSP, CCSE, CCNA, CCAI, Network+, Security+, JNCIA, & MCP
<<

sargule

Newbie
Newbie

Posts: 8

Joined: Tue Jan 01, 2008 11:59 am

Post Sat Feb 02, 2008 10:09 pm

Re: Monitoring for new machines on the network

Yes, they support SNMP. Is there someway for a switch to periodically dump its CAM table. That would give information about MAC and ports.
<<

slimjim100

User avatar

EH-Net Columnist
EH-Net Columnist

Posts: 385

Joined: Wed Nov 08, 2006 12:50 pm

Location: Atlanta

Post Sat Feb 02, 2008 11:49 pm

Re: Monitoring for new machines on the network

You will need to MIB walk the switch to see what it supports but you should be able to have it broadcast the port and switch name with every active connection. Rhis look to the time stamp and compare it too the IDS or program you have that tells you a new client is online.

Brian
CISSP, CCSE, CCNA, CCAI, Network+, Security+, JNCIA, & MCP
<<

federal

Newbie
Newbie

Posts: 1

Joined: Sun Feb 03, 2008 4:50 pm

Post Sun Feb 03, 2008 5:14 pm

Re: Monitoring for new machines on the network

Can you identify the new member by the ISP?
Name/Location/Telephone?
<<

slimjim100

User avatar

EH-Net Columnist
EH-Net Columnist

Posts: 385

Joined: Wed Nov 08, 2006 12:50 pm

Location: Atlanta

Post Sun Feb 03, 2008 9:27 pm

Re: Monitoring for new machines on the network

federal,

We are talking about local LAN switches and I am nit sure what you are trying to ask because the ISP would be at the gateway of the network and would be your networks ISP...

What are you trying to ask here?

Brian
CISSP, CCSE, CCNA, CCAI, Network+, Security+, JNCIA, & MCP
<<

slimjim100

User avatar

EH-Net Columnist
EH-Net Columnist

Posts: 385

Joined: Wed Nov 08, 2006 12:50 pm

Location: Atlanta

Post Sun Feb 03, 2008 10:03 pm

Re: Monitoring for new machines on the network

Other ideas on managing your switched network is to enable layer2 security features on the switch if it supports it. This could help with Man in The Middle Attacks, spoofing, & VLAN jacking. You could use VLANs by switch, floor, port, or any other idea you may have. The power of VLAN's is often over looked on the switches if they support it. As for SNMP you could code out a program to send mibs to your switches to show you port status and details on connection. If you comment on the ports with the details like room numbers for ports or other helpful details on where the other end of the port is the SNMP could send this detail when someone plugs in so you know when and where the connection is made. Let me know if you have questions.

Brian
Last edited by slimjim100 on Sun Feb 03, 2008 10:05 pm, edited 1 time in total.
CISSP, CCSE, CCNA, CCAI, Network+, Security+, JNCIA, & MCP
<<

g00d_4sh

User avatar

Sr. Member
Sr. Member

Posts: 394

Joined: Tue Sep 18, 2007 1:50 pm

Location: Guayaquil, Ecuador

Post Mon Feb 04, 2008 11:33 am

Re: Monitoring for new machines on the network

We have some VLANs set up at my work, and I"m pondering doing a port security implimentation as well.  Honestly I don't know enough about the snmp for answering the original question of the post, but I'm assuming Slimjim's answers are good.
"Bad.. Good?  I'm the guy with the gun"
<<

slimjim100

User avatar

EH-Net Columnist
EH-Net Columnist

Posts: 385

Joined: Wed Nov 08, 2006 12:50 pm

Location: Atlanta

Post Mon Feb 04, 2008 11:55 am

Re: Monitoring for new machines on the network

SNMP with MIBs can let you control or poll anything from a device that supports SNMP. You will need to get the vendors MIB/SNMP tables and then with a little PHP and some scripts you could do anything you need to your network. 90% of the vendors tools out there are sending SNMP traps and MIBS to configure the devices. Like Cisco's config maker is using SNMP and Http to talk to the devices and make config settings.

Brian
CISSP, CCSE, CCNA, CCAI, Network+, Security+, JNCIA, & MCP
<<

sargule

Newbie
Newbie

Posts: 8

Joined: Tue Jan 01, 2008 11:59 am

Post Mon Feb 04, 2008 1:39 pm

Re: Monitoring for new machines on the network

Thanks Slimjim,
The network is managed by a separate group. There are scripts out there that help do so, but from what I have seen, it needs good amount of scripting.
For now, they have agreed to implement port security on open ports that will let us know if something was connected to those ports. (Not necessarily MAC/IP info, but just an indication that the port came up or went down). We would then use it with our DHCP log alerts to identify the location. Lets see how it goes. Thanks for all the inputs.
<<

dean

Post Mon Feb 04, 2008 9:03 pm

Re: Monitoring for new machines on the network

sargule,

If you've manged to get your network group to enable SNMP LINK UP/DOWN traps either globally or on a per port basis then see if you can get them to enable MAC-NOTIFICATION-TRAPS as well (Cisco-centric command, not sure of equiv on other switches). This will let you know the MAC Address of a device connecting to that port.

Have a look at netdisco. You can use it to locate the port that the user/device is on by IP or MAC.

www.netdisco.org

dean

Return to Other

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software