Re: internal network mapping & traversal

["Paul Melson" <pmelson () gmail com>]

> Even completely firewalled devices typically will respond to arp probes.

Be careful with this assumption.  It's generally true of host
firewalls, but if the firewall is part of the infrastructure (Cisco
FWSM, for example) or is a separate device, then ARP responses will
only be for the local firewall interface and any NAT addresses
configured on the firewall.  And the proxy-ARP responses from the
firewall won't be representative of which hosts are up or down, or in
the case of global/hide NAT, how many hosts are actually behind them.
I would be especially aware of these caveats if you determine that
switchport 802.1X or some other NAC-type-thing is in play.

PaulM

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Top 5 Common Mistakes in 
Securing Web Applications
Get 45 Min Video and PPT Slides

www.cenzic.com/landing/securityfocus/hackinar
------------------------------------------------------------------------