Bugtraq mailing list archives
Re: Tool for Identifying Rogue Linksys Routers
From: Paul Halliday <paul.halliday () gmail com>
Date: Fri, 26 Aug 2005 21:41:12 -0300
Why not arpwatch? It is tiny, simple and passive. On 8/25/05, Matt Mercer <MattM () pyramidcorporation com> wrote:
Hi Martin,We are migrating from Lucent QIP to MetaIP for DHCP services and so far we have had two issues when MetaIP has been implemented for VLAN that has an unauthorized Linksys router giving out IP addresses.If you have an IDS such as Snort configured on your network, it would be fairly straightforward to build a configuration watching for DHCP traffic on specific VLANs not originating from legitimate servers (as defined by you, The Administrator). Find a helpful article here describing such a scenario: http://security.itworld.com/4363/ITW3542/page_1.html HTH, Matt
-- _________________ Paul Halliday http://dp.penix.org "Diplomacy is the art of saying "Nice doggie!" till you can find a rock."
Current thread:
- Tool for Identifying Rogue Linksys Routers Martin Mkrtchian (Aug 25)
- Re: Tool for Identifying Rogue Linksys Routers Mike Frantzen (Aug 26)
- Re: Tool for Identifying Rogue Linksys Routers Joshua Wright (Aug 26)
- Re: Tool for Identifying Rogue Linksys Routers Graham Wilson (Aug 26)
- Re: Tool for Identifying Rogue Linksys Routers Volker Tanger (Aug 27)
- Re: Tool for Identifying Rogue Linksys Routers Mike Kershaw (Aug 27)
- Re: Tool for Identifying Rogue Linksys Routers Dave Hull (Aug 26)
- Re: Tool for Identifying Rogue Linksys Routers Tony Rall (Aug 27)
- <Possible follow-ups>
- RE: Tool for Identifying Rogue Linksys Routers Thomas Guyot-Sionnest (Aug 26)
- RE: Tool for Identifying Rogue Linksys Routers Matt Mercer (Aug 26)
- Re: Tool for Identifying Rogue Linksys Routers Paul Halliday (Aug 27)