At 10:33 AM 1/21/2005, you wrote:
Well I'll need to have some more info on
SHOOT: what should we use? How can we know how to aim?
Scary thing is... there's some halfway decent face recognition software out there that can include some tracking options.. so just plug in your webcams... have a database of faces....
OFFERNDER: how to detect the offender? (shooting the offending server might be a good start, but the person even better I suppose?)
That's the harder part. Perhaps use a tranq gun and simply shoot everyone in site and sort it out later.
Dirk.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tobie Fysh Sent: Friday, January 21, 2005 4:20 PM To: '[email protected]' Subject: RE: [SA-list] DHCP Errors
I'll second that..... Dirk can we have a development schedule please!
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Farmer, Marcus Sent: 21 January 2005 15:03 To: [email protected] Subject: RE: [SA-list] DHCP Errors
Any chance ServersAlive might have a new alert option - shoot the offender - sometime in the future that automatically takes care of people that cause such issues? >:-)
Marcus L. Farmer Systems/Network Manager Metron North America (865) 523-6700 ext. 2282 [EMAIL PROTECTED]
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stephen Gordon Sent: Friday, January 21, 2005 9:49 AM To: [email protected] Subject: Re: [SA-list] DHCP Errors
Bad news is that I know of a way to do it, but its not through SA.
Good news is that its free!
Have a look at the following article which explains using Snort as a method for detecting rouge DHCP boxes.
http://security.itworld.com/4363/ITW3542/page_1.html
It works and I have it in production at the moment (I too have little tinkers who like to play with trial software disks)
The above has been invaluable for detecting unauthorised wireless routers on the site as most of them have DHCP turned on by default.
Hopes this helps and if anyone wants off list info about Snort I am more
than happy
Cheers
Stephen
Tobie Fysh wrote:
> Weep > > I think I'll just wait until it happens again and then shoot the > B********'s who install it. > > Can we notch this down as something SA CAN'T do? ;-) > > Best wishes > > Tobie > > ---------------------------------------------------------------------- > -- > *From:* [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > *On Behalf Of *Michael D. Shook > *Sent:* 21 January 2005 14:21 > *To:* [email protected] > *Subject:* RE: [SA-list] DHCP Errors > > BEWARE: > > IF you think about doing this as an external check, the protocol has a > built in timeout. So, for any given DHCP request series, you may or > may not see all or any of your DHCP servers. On large subnetted or > busy LANs it is not unusual to see several requests sent before a DHCP
> server can respond. The NIC will take the first one it gets and > ignores the others. I don't think the NIC will even report seeing the > others as those packets are dropped. > > Michael D. Shook > Technical Analyst > [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> > 863 668 4477 (work) > 863 860 4070 (cell) > 863 665 1261 (fax) > _www.saddlecrk.com_ > <file:///C:/Documents%20and%20Settings/MichaelS/Application%20Data/Micro soft/Signatures/www.saddlecrk.com> > > > ---------------------------------------------------------------------- > -- > *From:* [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > *On Behalf Of *Dirk Bulinckx > *Sent:* Friday, January 21, 2005 9:06 AM > *To:* [email protected] > *Subject:* RE: [SA-list] DHCP Errors > > When a DHCP client sends out a DHCPREQUEST and the DHCP server(s) > respond with a DHCPOFFER. BUT since this is based on broadcasts this > will only "show" DHCP server that are within the same broadcast > segment. (exception to that is when you have a DHCP/BOOTP relay agent > which can forward the request to a DHCP server in another segment too) > You would then need to be able to have a list of valid DHCP servers > and compare the responses you get to those that are within the list. > If there an answer from a server that is not within the list, there is > a "problem" (or better a new dhcp server). > > That's the logic to follow, so all you have to do now is to write an > external check for this :-) > > > Good luck. > > > Dirk. > > > > ---------------------------------------------------------------------- > -- > *From:* [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > *On Behalf Of *Tobie Fysh > *Sent:* Friday, January 21, 2005 11:29 AM > *To:* '[email protected]' > *Subject:* [SA-list] DHCP Errors > > Hi everybody, > > Okay this is going to sound like a laugh but last night one of our > techs was playing about with a build of a test server and installed a > DHCP server onto it (Win2K3), he built it onto different IP range so > this morning some PC's decided to start looking at this server instead
> of our normal one leading to problems all over the place. > > My question is - Can SA check for new DHCP servers being added to the > network? (We've got a rogue department who install stuff as well as > technicians who do!!) > > Regards, > *Tobie Fysh* > To unsubscribe from a list, send a mail message to [EMAIL PROTECTED] With the following in the body of the message: unsubscribe SAlive To unsubscribe from a list, send a mail message to [EMAIL PROTECTED] With the following in the body of the message: unsubscribe SAlive To unsubscribe from a list, send a mail message to [EMAIL PROTECTED] With the following in the body of the message: unsubscribe SAlive
To unsubscribe from a list, send a mail message to [EMAIL PROTECTED] With the following in the body of the message: unsubscribe SAlive
Greg D. Moore Director of IT [EMAIL PROTECTED]
Powerone Media 1-800-6POWER6 http://www.poweronemedia.com
Security Tip: When possible, use a passphrase instead of a password.
To unsubscribe from a list, send a mail message to [EMAIL PROTECTED] With the following in the body of the message: unsubscribe SAlive
