Nmap questions concering my router

snipped-for-privacy@painkiller.example.tld (Moe Trin) wrote in news: snipped-for-privacy@compton.phx.az.us:

I hope you're not doing a flat fee.

Duane :)

I also forgot to ask you who is the one that automatically configure the routes. I didn't do it myself in xp(neither i knew how to od it), so i guess that the DHCP server running on my Speedtouch 530 Firewall did it because i have the router assign ip addresses to localhosts(even if i only got 1 :-). instead of manuall assign the 10.0.0.1 address in my eth0's tcp/ip properties.

True?

That's a mini-howto - it's just one of the ways. Don't forget, the interface is only looking at MAC (hardware) addresses. This does take special or extra software, but that's another matter.

No, this is a dynamic function. It's generally used for outbound connections - where you have several computers that want to surf, but only one public address. Windoze calls this connection sharing as I understand it.

Port translation, or port forwarding - this is used when you are offering network services externally where the server is on am internal host. If you ran IP Masquerading, with basic rules, it doesn't allow you to offer external service. If someone connected to port 80 on your router, and you are not forwarding that port to some specific place, they would receive an error, because there is no server - "Port Unreachable".

OK

or a switch

Yes. This means you don't need a gateway or router to connect - just send it directly to the other computer.

Yes

Yes

It gives a standard location to "talk" to. For example, I'm running X and have twenty terminal sessions open on six desktops. My typing is actually sent as a network connection to the terminal where the letters appear. This allows me to be typing in _this_ terminal and

oh - you couldn't see me type the rest of that sentence, because I moved the mouse cursor to another terminal, and my keystrokes went there instead. I'm actually monitoring some jobs at work, and eating lunch while I type this to you.

Yes - in fact, that is a problem that happens some time. The cable gets unplugged, and the user can't connect outside. They tell me that they can ping their own IP address, so networking must be OK...

Remember this picture?

Ethernet_header IP_header TCP_header GET mumble.foo.bar/baz.html CRC

The IP address in the IP header is 83.151.221.52. The address that is in the Ethernet header is the MAC address of the 10.0.0.138 interface. The IP address of 10.0.0.138 isn't found in any header at all.

The purpose of a router is two connect to networks. The only restriction is that the addresses of the two networks must NOT be the same. Think, if

(And in answer to your question to Ken in the 'Firewall Appliance Question' thread - a router is to connect networks. Firewalling is not a requirement to do that job, and most routers do not include firewalls. Your's does, but it also includes a hub which is not needed to the it's job either.)

No - exactly the opposite is true. In fact, there is another problem that we see in networking newsgroups all the time - a person has two or more interfaces, and puts them all on the same network (example 10.0.0.1/eth0,

In your property, you can do what ever you'd like (well... the neighbors may complain if you took your clothes off and danced about where they can see you, but OTHER THAN THAT). If you want to use RFC1918 addresses, that's fine. If you have three networks and they use 10.0.0.0/24 for one,

I don't know. DNS seems to indicate there is only one host, but looking at other addresses, I suspect the addresses are actually in someone's hosting service, rather than at the hotel. That is only a guess, but it does not surprise me.

Look at that diagram (above and in the Wednesday posting) again. The IP address is where the packet is going to reach the application you want to use (web server, news server, DNS, what-ever). If you send a packet to the router's internal address, you want to talk to something that is running on the router. This _could_ be a port forwarding application, but that's a special case. If you want to talk to the Dai-ichi Hotel, they are not on your router, so you send the packet to 210.151.247.138. The networking stack creates the packet with the destination IP address

Yes, I've been asking my banker about the conversion rate between Euros and Golden Aardvarks - they haven't gotten back to me yet. ;-)

Old guy>

Your O/S

Oh, that's an old one - that's also a mini-howto. When you installed your O/S, you told it (or windoze guessed) that you would be using DHCP, and a DHCP client was installed. The manufacturer of your router set up software it is running to include a DHCP server.

DHCP (actually, the preceding protocol BOOTP) was created for the situation where there were many computers, and not enough IP addresses for all of them. When RFC1918 was standardized (replacing the original RFC1597), about 17.8 million addresses became available for local use, so dynamic address sharing was no longer needed.

DHCP has the advantage that the person who sets up the computer doesn't need to know anything. The complex stuff is on the server, and it's assumed that the person who sets up the server knows what they are doing. In your case, the person who set up the DHCP server was the router manufacturer. This only works where the person who set up the server has made the correct guesses about what you may want to do.

Microsoft adopted DHCP for system address configuration when they finally introduced TCP/IP networking in 1995, because they knew it was expecting to much of the average user to know how to assign IP addresses. It's a security hole (because addresses are meaningless, and may be given to anyone), but their original small office networking scheme used the same lack of security, so why worry.

DHCP can be made more secure, with extra work on the server application that can only be done on-site (example, in your house), but this requires more skills. My opinion is that it is easier to set up hard (static) addresses on each computer than to set up DHCP securely. The seven computers in my house are all done that way, as are the more than 1800 systems where I work.

Old guy

Check up thread - hourly _and_ per line. This _is_ supposed to support my local bartender, isn't it? ;-)

Old guy

You mean eth0 needs only to know 10.0.0.138's MAC address to talk to? Ok, but does one NIC can have more than 1 ip address? I want to read the file but i dont have it.

So IP Masquerading handles outbound traffic only while Port Forwrding handles inbound traffic? Thats the distinction?

If it is so, is it acceptable to say that:

IP Masquerading = Source NAT Port Forarding = Destination NAT?

I think we can call it this way based on your definition above. So actually there is only 1 concept (NAT) with 2 sides, like a coin. Sourse(ip masc)/Dest(port trnaslation). I hope i got it right this time :\\

Sorry i didnt understand that at all as to what does have to do with

Well it was 3:00+am when i posted this and i lsot count ;-)

:-)

Yes. But the MAC address couldnt have been directly the 83.151.221.52's one , could it? It has to pass from 10.0.0.138 first because the routing table says so? What happens if we alter the routing table by changing the gateway from 10.0.0.138 to 83.151.221.52

True! Send data to .153 host in the first network or in the second one since this ip address exists in 2 both networks? Send data directly to 153 from the hub in the first one or use the routers 2nd interface as gateway to reach the other side? Problem!

It also is a modem! :-) so its a hub/router/firewall/modem , lol :-) If it could also make coffee as well it would be even better :-)

OK, NOW iam confused! Up until now i though that 2 nics(eth) must be on the same subnet in order to be able to cumminicate without the need of a router, who's job is to interconnect 2 differenent netwroks in order for the 2 remote hosts to communicate.

The router is needed for the 2 hosts to be able to "talk" because they are in different subnets.

If they werent in different subntes they are considered to be on the same wire so they can "talk" directly through the hub.

Also if it aint too much trouble i appreciate if you can give an example of yhe 3 NICS above being on the same pc and also being ton the same network.

You mean one host has been assigned 8 different public ip addresses? Buw is this possible? Up until now i thought that 1 ip address can only have several different hostnames(aliases) not the other way around cause i thought that 1 NIC has 1 hardware address(MAC) and 1 software address(ip address).

I dont quite follow...

Yes and in that case the mac address of the routers internal! But the ethernet packet couldnt be destined directly to the routers external could it? It has to pass from the mac of 10.0.0.138 before it reaches the routers external.

I hope they cant do it, i dont even know of such currency like Golden Aardvarks i hope thay dotn either :-), but in case they do, iam hoping for a discount! ;-)

Until then i ll just keep on asking :-)

Can you clarify that i bit more please?

As i asekd before i dont really understand what amkes a DHCP server unsecure.

Where do you work, if you dont mind me asking? :-) And you are an IT manager there if understnad correctly.

A basic DHCP setup will not do to be secure against spoofing.

DHCP security related options like i.e. IEEE 802.1X / RADIUS are required to be secure against such attacks.

And this requests to have IEEE 802.1X in the switch and a RADIUS server up and running. This is more complicated that a simple DHCP setup.

BTW: static addresses are not secure against spoofing either ;-)

Yours, VB.

You mean that someone could pop into a lan through an empty socket and therefore an ip address will automatically be assigned to his NIC from the routers DHCP server, so he can have access to the lan even if he is unauthorized?

And we use hard(static) ips? What happens then? Hows that unsecure as well? He can use a static ip address by another machibe because the original machine would sue the ip address. How is this unsecure?

No. Usually, one will sniff a little bit first, and then manually configure a free IP address in the network. Or one will use ARP poisoning to spoof an interesting IP address. Or one will DoS attack a host, and replace it with the own box with the same MAC and IP address ;-) All of this will require access to local hardware or to some radio network.

The same.

As described.

The only secure way is, to have a concept implemented like securing physical access and access to radio networks, or securing the switching i.e. by using 801.1x.

Yours, VB.

You mean he'll check the ip pool and then assign himself one ip address from that pool that is not currently in use?

ARP poisoning?!?

Replace it?

You mean the 3rd way needs physical access to get the nic card and put it it on another machine?

Can you be more specific please?

It's a bit off topic - but down at the Ethernet level, the packets are addressed using the MAC address. As for the HOWTOs, go to

That's the simple version, yes. Once a connection is established, then NAT occurs in both directions. Think about that - you want to connect out, so your router masquerades for you. But a TCP connection is two-way, so the remote site has to be able to reply to you, and the router does a dynamic port forwarding back to your system so that the connection is complete.

The application only need to worry about connecting to a network, and have that move the packets to the desired (other) application on the system. We don't have to care what that other application is, or how it may differ from other applications - we just send data to a network address.

No, because you are not on the same network. You can only reach addresses on your network directly (without using a gateway), and you can only reach addresses that are not on your network by using a gateway, to transfer the packets to some other network that will (eventually) reach the remote network that has that remote address.

Yes, because 10.0.0.138 has been defined as the gateway address on your LAN.

How do you reach 83.151.221.52? It is not on 10.0.0.0/24. To reach ANY address that is not on 10.0.0.0/24, you need to be able to send packets to a host on 10.0.0.0/24, and let it forward them to the "remote" network.

This is the same problem discussed above - two interfaces ON THE SAME COMPUTER have to be on different networks. On the other hand, two interfaces ON DIFFERENT COMPUTERS must be on the same network to talk.

on the same computer

The problem here is that the computers get confused about which address to use. If I try to talk to 'Nicky', and 'Nikos' answers, those names are not the same, so I think this is two conversations. How am I to know 'Nicky' and 'Nikos' are the same person? They have different IP addresses ;-) If 'Nikos' answers, the packets have his IP address (even though on your local wire, you may relay the packet from 'Nicky' to the router, but I won't know that).

on different computers

Yes. And what I thought you were referring to was two NICs in the same computer. To talk to these to, the computer would use the loopback or internal interface.

Yes and Yes.

Without "special" or "extra" software, when there are multiple interfaces on the same computer on the same network, the computer will _listen_ to all addresses (and may listen using just one interface to receive all three - depends on the O/S), but when it talks, it only uses one interface (depends on O/S - may be the first one configured, or may be the last). The other NICs may be unplugged, and while the statistics would show only one interface being used, packets addressed to all addreses would be received.

No, only looks like one computer active, the other addresses not in use.

It's possible, and if done right, you would not know. If done wrong, it probably would not work.

Advanced subject - yes it is possible, but it's complex.

Many Internet computers are not located where the hostname says. A hotel is not expert at running computers, so they may rent a computer from a special ISP called a hosting service. An example would be a company called 'rackspace.com' who operates a number of locations, each with several hundred to several thousand computers. They provide a large bandwidth connection, good power, security, and well trained people to keep an eye on things.

But it won't reach the external interface. You send it from "inside" to the internal interface of the router. The IP packet is inspected to see who we want to send it to, and that is 83.151.221.52... wait a minute, that's me!!! Push this up the stack, there is no reason to send it on another hop (which would go on the loopback anyway), so we can save some CPU cycles.

Old guy

Volker has given an explanation. There is an additional problem in that you have no assurance that the computer with address 1.2.3.4 is the one on user "Joe"'s desk, or the computer on someone else's desk. The addresses are assigned randomly. At least with a static setup, you have some expectation which computer might be which.

Yes, if you allow someone to mess with the computers, a static address may be spoofed (we don't give out the root or admin password to our users), and we also don't allow "visiting" computers.

By default, DHCP hands out the next available address to anyone who asks. You can configure the server to hand out addresses based on the MAC address of the client, but the MAC address can be altered on many clients. "man ifconfig" and look for the 'hw' option.

You can configure some clients to ask the DHCP server for a specific IP address, but this is even easier to spoof.

There are some cryptographic add-ons that can be used, but these are limited to specific O/S, and I haven't seen enough to give me the confidence needed.

IP Name service is seeing new hooks to allow the DHCP server to update the DNS, but again, I've not got confidence in this yet. The original WINS listens to the clients, and gets their name directly from them. And no one would _EVER_ spoof that, right?

I don't mind, but the company does. I'm under a Non-Disclosure-Agreement.

No, I'm a network administrator.

Oh, and I see that Volker is in Germany, so he can charge you directly in Euros - no worry about converting into Golden Aardvarks. ;-)

Old guy

Malicious or unintentional spoofing.

So far, these haven't gained acceptance here.

Putting it mildly - but then, DHCP was never meant to be secure.

Malicious spoofing, true - but that's why we also have additional monitoring, and have policies in place that allow us to instantly terminate offenders. That's also why we don't allow visiting computers.

Old guy

Rather difficult on a switched network - and we monitor our switches

Change to managed switches with "hard coded" MAC tables.

which is why we control access to our facilities, and don't use WiFi.

Depends on how paranoid you need to be. Local legal requirements mandate that we have published policies, signed by every user, and large signs at every entrance reminding everyone that the network is monitored, and miscreants will be subject to legal prosecution. Some of this is a contract requirement with our customers, while other parts are merely extensions of common sense.

Old guy

Switching itself does not prohibit this. Are your switches managed, do you have a fixed asignment of MAC and IP address to switch port?

Yes. As I stated ;-)

Good idea.

I meant, secure against spoofing attacks in the LAN by manipulating MAC or IP address assignment.

Yours, VB.

Charge?

Yours, VB.

Hate to jump in here, but I've also seen a problem with DHCP that you've not mentioned - it was reported that a chap running a DHCP service on his laptop, visiting a company (not one of our clients), left his DHCP service running and connected to their network - when the Windows 2003 server running DHCP on the company network detected another DHCP server it stopped the Windows 2003 DHCP service and it would not restart without a reboot. Interesting way that worked.

Yup - years ago, we even went with hard-coded ARP tables on all systems and disabling ARP on the network. It worked, but it was a tremendous hassle.

We're slowly transitioning away from copper Ethernet, and going to fiber. Sort of a 'security by obscurity', but not that many people have the NICs needed, and we don't leave patch cords laying about. As with the copper net, we don't leave unused ports live (never mind allowing visiting computers), so there is a bit less risk there. Our users are away of the concerns about security (though they still won't let us behead miscreants and put their heads on pikes in front of the employee entrances), and that also reduces the risks. There are other things I can't mention, but any paranoid admin would think of them if pressed.

Old guy