1
00:00:00,930 --> 00:00:02,850
...edition of DEF CON.

2
00:00:02,950 --> 00:00:06,230
Those are the hours that start at 8 and never end.

3
00:00:07,750 --> 00:00:17,110
My name is Ophir Arkin, and I will be speaking today about infrastructure discovery.

4
00:00:17,110 --> 00:00:24,910
Usually, a lot of people at DEF CON talk about how to break things.

5
00:00:26,410 --> 00:00:31,110
How to search cool stuff, how to take something and to break it.

6
00:00:31,110 --> 00:00:42,630
Most of the people that I know from the world that actually do network security, they are in charge of how they maintain their stuff.

7
00:00:44,870 --> 00:00:52,090
This talk is basically going to speak about what kind of knowledge and how we get it from an enterprise network.

8
00:00:52,090 --> 00:00:55,750
How do we acquaint ourselves with our users.

9
00:00:55,930 --> 00:01:03,070
How do we acquaint ourselves with the machines that operate on the network and with actually what is being done on the network.

10
00:01:03,070 --> 00:01:09,290
Usually, if you look at the DMZ, the DMZ is usually well fortified.

11
00:01:10,110 --> 00:01:13,430
Most of the things are already there.

12
00:01:13,430 --> 00:01:18,870
Most of the firewalls that we have can block 90%, 95% of all attacks.

13
00:01:18,870 --> 00:01:23,710
We can put another system where we are 99% protected.

14
00:01:23,710 --> 00:01:30,350
The guys that understand how to defend themselves, they are actually pretty good at doing that.

15
00:01:30,350 --> 00:01:33,610
Usually, it's not that hard to do that.

16
00:01:33,610 --> 00:01:36,790
You just need to understand what you need to do, what you need to defend.

17
00:01:36,990 --> 00:01:39,510
That's another interesting question.

18
00:01:40,510 --> 00:01:50,250
The talk will be... well, I'll try to do it really fast so they can take one of those walls down and have the ball here.

19
00:01:51,010 --> 00:01:55,270
We're going to talk about why do we need infrastructure discovery.

20
00:01:55,610 --> 00:02:00,130
Why active network discovery and passive network discovery are not that good and what can we do.

21
00:02:00,650 --> 00:02:13,350
I will demonstrate to you a new, agent-less, real-time approach that enables us to have real-time information about our infrastructure and to allow us to do monitoring and auditing.

22
00:02:16,110 --> 00:02:18,690
A bit about myself, I'll do that pretty fast.

23
00:02:18,690 --> 00:02:21,690
I'm the Chief Technology Officer for InsightX.

24
00:02:21,690 --> 00:02:23,590
I'm also the founder of the Cisco Security Group.

25
00:02:23,590 --> 00:02:26,390
Most of you know me from my previous work.

26
00:02:26,390 --> 00:02:28,790
ICPSR Scanning Expert 2.

27
00:02:29,810 --> 00:02:32,590
And other things that I've published along the years.

28
00:02:32,590 --> 00:02:35,270
I'm also a member of the Voice over IP Security Alliance.

29
00:02:35,990 --> 00:02:37,070
Let's go.

30
00:02:37,110 --> 00:02:39,790
Okay, so you have an enterprise network.

31
00:02:39,850 --> 00:02:41,550
It's large, it's complex.

32
00:02:41,590 --> 00:02:43,410
A lot of things operate there.

33
00:02:43,830 --> 00:02:53,310
Usually it may be combined from multiple networks in different locations.

34
00:02:53,310 --> 00:02:57,570
And basically there are a lot of nice things that operate on the network.

35
00:03:00,150 --> 00:03:01,770
Some of those are mission-critical.

36
00:03:01,770 --> 00:03:05,910
Mission-critical is a nice definition that says a lot of things to different people.

37
00:03:06,130 --> 00:03:11,770
At the end of the day, we need those systems to work in order not to have some financial damages, another nice definition.

38
00:03:12,050 --> 00:03:21,170
But at the end of the day, mission-critical means that if those systems are down or if those systems cause some kind of a problem, it means that other systems suffer.

39
00:03:21,170 --> 00:03:29,250
So for some, mission-critical means the servers, the networking gear, and for others it means also the desktops.

40
00:03:29,310 --> 00:03:42,090
If you had suffered an outbreak of a worm that hit a desktop and that desktop brought down your access switch or other things on your network, then that desktop is mission-critical to you.

41
00:03:44,730 --> 00:03:53,730
IT basically needs to take care of a lot of things that are actually important for the regular operation of the network.

42
00:03:53,950 --> 00:04:02,890
We need the network to be available, we need the elements to be available, we need to maintain the security of the network, and of course the availability of whatever is on the network.

43
00:04:03,030 --> 00:04:05,290
So basically IT has a ton of work.

44
00:04:05,290 --> 00:04:17,950
Usually the CIO will come to IT and say, well, you have enough people that needs to maintain what we have, just invest in smarter management systems.

45
00:04:18,370 --> 00:04:33,390
So IT needs to identify what are the assets, what they mean to the organization, their properties, their roles, the different interdependencies, what would happen if one of them would fail, how that will affect the IT organization and the business process,

46
00:04:33,390 --> 00:04:36,590
to understand the importance of those assets.

47
00:04:37,030 --> 00:04:48,910
A lot of boring stuff, which at the end of the day is very critical to be done, because if we're not doing this, we don't stand a chance to actually run an IT organization.

48
00:04:48,910 --> 00:05:05,910
And we have here a lot of things that relate to provisioning the network, provisioning the elements, know what we're defending, knowing what we're managing, detect and troubleshoot issues, defend our assets, eliminate those systems that actually pose a risk to some of our assets,

49
00:05:05,910 --> 00:05:12,130
and of course do other things like prepare for the worst, do disaster recovery, disaster recovery management, and a lot of other things.

50
00:05:12,130 --> 00:05:18,630
The problem is that in order to do all of those things, we need information.

51
00:05:18,630 --> 00:05:32,770
We need information about the network layout, how does our network look like, another worker at your local burger store.

52
00:05:37,980 --> 00:05:50,060
Okay, so we need to know the topology, we need to understand what are our resources, and we also need to understand what are the elements that we actually need to manage and secure.

53
00:05:50,480 --> 00:06:03,940
So at the end of the day, we need intimate, complete, and accurate knowledge about our infrastructure, and without this kind of knowledge, it will be, well, we can't actually do management and security.

54
00:06:04,860 --> 00:06:12,460
The problem is that the information that we need is either unavailable, partial, or incomplete.

55
00:06:12,460 --> 00:06:16,100
This is because this kind of information is not easily produced.

56
00:06:17,340 --> 00:06:21,940
Some people in our organization may have had that information, but they left.

57
00:06:21,940 --> 00:06:29,040
Some of this information is dynamic, and some of the systems that we use in order to maintain that information are insufficient.

58
00:06:29,040 --> 00:06:35,380
So at the end of the day, if we don't know the network, we can't actually manage or secure it.

59
00:06:36,500 --> 00:06:39,520
This brings us to this slide, to the result.

60
00:06:39,520 --> 00:06:43,660
The result is that we always work at the 80-20 rule.

61
00:06:43,700 --> 00:06:44,840
And you know what?

62
00:06:44,840 --> 00:06:51,140
The 80-20 rule is really bad when you do management for networking and for security.

63
00:06:51,140 --> 00:06:52,100
Because you know what?

64
00:06:52,100 --> 00:06:54,320
The 80% that I know of, you know what?

65
00:06:54,340 --> 00:06:55,900
I'm managing them right.

66
00:06:55,900 --> 00:06:59,480
I'm doing all the things that I need to do for them right.

67
00:06:59,480 --> 00:07:07,760
But those other 20% that I'm able to uncover, that I don't know what they are in my organization, those that actually pose the highest risk for me.

68
00:07:08,020 --> 00:07:10,260
Well, the highest risk can come from a compromise.

69
00:07:10,260 --> 00:07:14,160
The highest risk may come from auditing perspective.

70
00:07:14,160 --> 00:07:18,380
The highest risk may come from a lot of things, but at the end of the day, I don't have control.

71
00:07:18,380 --> 00:07:23,580
I cannot understand what I have, and I have full sense of control and full sense of security.

72
00:07:23,780 --> 00:07:27,780
And when I have these, then it's all downhill from there.

73
00:07:28,140 --> 00:07:34,840
So along the years, there were several technologies that were trying to solve the issue of knowing the network.

74
00:07:34,840 --> 00:07:51,880
Basically, what they were trying to do is, they were actually trying to have the topology of the network, understand what are the elements that reside on the network, what their properties are, and they maintain this information up to date.

75
00:07:51,880 --> 00:07:57,140
It seems that this is a definition that is very small, right?

76
00:07:57,140 --> 00:08:00,720
It contains everything, but it has a lot of problems in it.

77
00:08:00,720 --> 00:08:07,500
Doing network topology, if some of you are using network management systems that claim that they do this, it's a hard thing to do.

78
00:08:07,500 --> 00:08:08,640
It's not that easy.

79
00:08:08,640 --> 00:08:15,020
It's not that easy to say which switch is connected to another if you do not use CDP or other proprietary protocol.

80
00:08:15,320 --> 00:08:20,820
It's also not easy to produce the information about what actually lies on the network.

81
00:08:21,660 --> 00:08:26,540
So, let's start with one of my favorites, Active Network Discovery.

82
00:08:26,540 --> 00:08:34,800
With Active Network Discovery, basically, we send some packets to the network and we hope that we'll see some responses from those elements on the network.

83
00:08:34,800 --> 00:08:42,240
And sometimes, according to those responses or the lack of, we will draw some conclusions about those elements.

84
00:08:43,880 --> 00:08:58,440
An Active Network Discovery system will try to get information about the inventory, meaning the elements, their properties, information about network services, the configuration, the topology, and if this Active Network Discovery is able to do vulnerability assessment.

85
00:08:58,440 --> 00:09:07,740
Usually, it will be installed on a single location on the network, although you can install it in multipoints, and we'll scan the network from that point.

86
00:09:09,300 --> 00:09:29,220
The way this can actually work is that an active tool can be fed with a list of IP addresses it needs to scan, or a list of networks it can scan, or that the Active Network Discovery tool will try to do that automatically by querying local elements and drawing that information from them.

87
00:09:29,220 --> 00:09:46,520
For example, HP OpenView, Tivoli, and other management systems go to the router, take the routing table, understand there are other networks they might need to operate against, and continually trying to detect other routers on the network, taking more and more IP address ranges,

88
00:09:46,520 --> 00:09:51,180
and from there, trying to enumerate all the information about the network.

89
00:09:54,100 --> 00:10:03,560
The strength that Active Network Discovery has mainly relates to the ability of active tools to completely control what they're asking for.

90
00:10:03,560 --> 00:10:20,100
They send the stimuli out so they can understand, well, we need this information from that element, we need that information from another, and they can also control the initiation of the scan, and also they can control the pace the queries are being sent.

91
00:10:21,060 --> 00:10:33,480
Technically speaking, if we're not having any kind of obstacles between the Active Network Discovery to the target, an Active Network Discovery system can scan entire IP address ranges.

92
00:10:35,980 --> 00:10:38,500
The weaknesses are a lot.

93
00:10:38,500 --> 00:10:41,720
I'll try to do something with the refresh rate pretty fast.

94
00:10:41,720 --> 00:10:43,200
Sorry if I can fix this.

95
00:10:45,360 --> 00:10:50,940
The weaknesses, well, the first one is that the discovery that will be done will be incomplete.

96
00:10:50,940 --> 00:10:54,820
This is since network obstacles on the network will prevent packets to reach their targets.

97
00:10:54,820 --> 00:11:10,160
If you have network-based firewalls, host-based firewalls, those Windows XP, SP2 that you installed and forgot that by default they have firewalls, and now you're unable to manage, not enable devices, load balancers, and other things that you put on a network will prevent the packets to reach their targets,

98
00:11:10,160 --> 00:11:13,280
and basically this will create black holes of information.

99
00:11:13,280 --> 00:11:20,140
So from a network that has a lot of elements, you'll discover that you have a very small network.

100
00:11:20,140 --> 00:11:21,440
Well, it's not true.

101
00:11:22,180 --> 00:11:30,140
Sometimes you'll need some type of information to be enumerated from those elements in order to draw your conclusions.

102
00:11:30,140 --> 00:11:30,720
And you know what?

103
00:11:30,720 --> 00:11:36,580
Sometimes those services will not be operating on those elements, and sometimes they will not be willing to speak to you.

104
00:11:36,720 --> 00:11:45,140
So, for example, if you need information from the Windows Remote Registry and you have the administrative rights for the domain, but the system is not a member of the domain, guess what?

105
00:11:45,140 --> 00:11:46,360
It will not help you.

106
00:11:46,360 --> 00:11:55,060
Also with SNMP, if you don't know the community strings of those routers that you want to enumerate, at the end of the day you can't draw the information from there as well.

107
00:11:55,360 --> 00:11:58,160
The process is very slow, it's time-consuming.

108
00:11:58,160 --> 00:12:01,660
By the time you get the information, the information that you get is obsolete.

109
00:12:01,660 --> 00:12:03,720
This is because it's not real-time.

110
00:12:04,420 --> 00:12:13,040
It also consumes a lot of network bandwidth, and it might take some elements down when it's actually doing the process.

111
00:12:13,040 --> 00:12:24,900
This is because sometimes it will overhelm the networking elements between the scanning system to the target with the amount of traffic it produces and will cause an out-of-service condition.

112
00:12:25,840 --> 00:12:28,740
So some folks went and said, well, you know what?

113
00:12:28,740 --> 00:12:32,340
We can do scanning at off-peak hours.

114
00:12:32,600 --> 00:12:40,020
We'll take our active network discovery systems or management systems, we'll take that to off-peak hours, and that will do it.

115
00:12:40,020 --> 00:12:43,060
Well, wrong, because you can't actually define what are off-peak hours.

116
00:12:43,060 --> 00:12:53,460
And sometimes during off-peak hours there are some crucial processes that actually are being done, like backup, restores, some reporting on your databases.

117
00:12:53,500 --> 00:13:03,220
So actually the process of probing those elements might not actually can be quantified to a certain time, and sometimes it may take longer than you actually know.

118
00:13:03,220 --> 00:13:11,900
A telecom company that I know runs HPOV against 4,000 devices and takes them 24 hours to complete the scan.

119
00:13:11,900 --> 00:13:17,560
Now, this is absolutely no-no if you're doing that against your operation network.

120
00:13:17,660 --> 00:13:20,080
So there are others who said, well, you know what?

121
00:13:20,080 --> 00:13:21,880
We'll do the scan faster.

122
00:13:21,880 --> 00:13:27,520
So we'll narrow the time that the scan needs to be done, and we'll finish it faster.

123
00:13:27,520 --> 00:13:29,940
Well, it's a good thing in theory.

124
00:13:29,940 --> 00:13:32,080
How many of you know NMAP?

125
00:13:32,080 --> 00:13:33,620
How many of you use NMAP?

126
00:13:33,620 --> 00:13:34,260
Cool.

127
00:13:35,040 --> 00:13:40,900
So someone can tell me what's the usual time that NMAP scans an element on a local network?

128
00:13:42,480 --> 00:13:43,760
Three seconds.

129
00:13:43,880 --> 00:13:45,660
How many packets does it send?

130
00:13:45,920 --> 00:13:46,920
1,500.

131
00:13:47,080 --> 00:13:48,560
So, let's see.

132
00:13:48,560 --> 00:13:53,720
If I scan my network, three seconds per element, 1,500 packets, that's a very bad thing to do.

133
00:13:53,720 --> 00:13:55,300
Try that on your local printer.

134
00:13:56,480 --> 00:14:02,340
Believe me, my printer cannot withstand that kind of faster scan.

135
00:14:02,540 --> 00:14:08,680
So whenever someone from my engineering team goes and uses NMAP by mistake, I know that I can't print.

136
00:14:08,680 --> 00:14:12,460
So I need to go to the printer, power it off, power it on, and then use it.

137
00:14:12,460 --> 00:14:18,060
And then see who's the engineer that was trying to play with network discovery on my network.

138
00:14:18,400 --> 00:14:23,580
So at the end of the day, this will cause disruptions on your network.

139
00:14:23,580 --> 00:14:26,400
Scanning faster is not the solution.

140
00:14:28,180 --> 00:14:32,780
And we go to the stability issues, which are the major ones.

141
00:14:33,820 --> 00:14:44,360
Basically, what those will cause, they will cause your machines to be unstable, like print servers, printers, other elements that cannot withstand a lot of traffic.

142
00:14:45,540 --> 00:14:51,640
And all of those, at the end of the day, will be denied of service.

143
00:14:51,640 --> 00:14:53,580
Doesn't help if I play with it, even.

144
00:14:53,800 --> 00:14:55,000
Sorry about that.

145
00:14:56,160 --> 00:15:05,740
This is because either the pace of the scan, the usage of non-RFC compliant packets, the type of information enumeration you're using.

146
00:15:05,740 --> 00:15:13,900
So if you're thinking that you can do network topology by taking the ARP tables from the routers, believe me, this is something that you do not want to do.

147
00:15:14,120 --> 00:15:26,560
You make the routers choke, you don't have connectivity to nowhere, and this is the last time that you will run an active tool on your network, because your CIO either will fire you or will tell you, this tool does not run on my network anymore.

148
00:15:29,520 --> 00:15:40,860
Some folks just forget that when they do invulnerability assessment, they shouldn't use those tests that actually cause denial of service.

149
00:15:40,940 --> 00:15:42,180
It's a bad thing.

150
00:15:42,900 --> 00:15:45,560
Against production machines, it's not a good thing as well.

151
00:15:45,560 --> 00:15:56,080
So sometimes the stability issues will arise just because there's the element between you and the scan target cannot withstand what you're doing.

152
00:15:56,080 --> 00:16:07,740
If you remember some of the old checkpoint and out-of-services where someone's scanning from the internal network, someone on the other end, what will happen is that all these state tables will be filled with information.

153
00:16:07,740 --> 00:16:12,960
They will wait for the timeout for the connections, but the state table is full.

154
00:16:12,960 --> 00:16:19,480
It cannot handle other legitimate connections, so what you have is a perfect denial of service that someone from the inside doing a pen test did.

155
00:16:20,180 --> 00:16:25,340
Also switches, they will be overhelmed by the number of connections and they will die.

156
00:16:25,620 --> 00:16:37,440
Believe me, it's very nice to, for example, I'll mention that later, if you span too much on a Cisco 3550, it's a party going on.

157
00:16:37,440 --> 00:16:41,080
It will send packets all over the place and you'll never understand networking in your life.

158
00:16:41,080 --> 00:16:42,220
You should see that.

159
00:16:42,660 --> 00:16:49,420
So, at the end of the day, the result is that some of the networks you have may be declared as active scan-free.

160
00:16:49,420 --> 00:17:08,000
You'll never be able to scan them at the end of the day because all of those other admins, the app admins, the network admins will come and say, well, we can't do this because you know that at the end of the day, I'll have denial of services and I don't want to do that in my production machine.

161
00:17:08,000 --> 00:17:15,700
So, there's a lot of production networks that are unable to be scanned because of these things.

162
00:17:15,700 --> 00:17:17,760
Nothing I do that helps me with this.

163
00:17:18,340 --> 00:17:28,260
So, we have some parts of your network unable to be scanned because people fear about active network discovery tools or previous history has proven them right about that.

164
00:17:28,700 --> 00:17:37,060
So, some people suggested that scanning, active scanning can be done in a different way.

165
00:17:37,060 --> 00:17:41,040
Let's see, let's have multiple machines scanning from the same place.

166
00:17:41,040 --> 00:17:42,620
It's actually called a cluster.

167
00:17:42,780 --> 00:17:43,220
Guess what?

168
00:17:43,220 --> 00:17:45,120
This doesn't help you actually.

169
00:17:45,120 --> 00:17:48,400
Because the scan is now distributed among several boxes.

170
00:17:48,440 --> 00:17:53,160
They scan the network at the same time and they send actually more traffic to the network.

171
00:17:53,160 --> 00:18:00,300
So, all of your denial of service conditions, all of your other problems are still there, but nothing is really a plus.

172
00:18:01,140 --> 00:18:06,360
Others were suggesting to put a proxy in each IP subnet or broadcast domain.

173
00:18:06,360 --> 00:18:12,180
That's actually a better idea because you can actually scan faster and you do not need to go through routers.

174
00:18:12,440 --> 00:18:18,820
But, at the end of the day, it doesn't give you any other advantage.

175
00:18:18,900 --> 00:18:22,100
Because, still, you need a pretty knowledge about what you have.

176
00:18:23,060 --> 00:18:29,360
The scan packet still might cause instabilities with the elements that are on the network.

177
00:18:29,360 --> 00:18:38,940
And, still, if you have firewall devices, not enabled devices and any other obstacles on your network, still, those packets will not go through those.

178
00:18:39,320 --> 00:18:47,680
So, basically, Active Network Discovery, at the end of the day, provides you with incomplete and, in some of the cases, inaccurate map of what you have on your infrastructure.

179
00:18:47,680 --> 00:18:49,120
Questions until this point?

180
00:18:51,960 --> 00:18:54,440
Because you have to understand what you have.

181
00:18:54,440 --> 00:18:59,380
The idea is that I don't want you to tell me what you have.

182
00:18:59,380 --> 00:19:02,240
I want my tool to discover it automatically.

183
00:19:02,240 --> 00:19:06,240
So, if you have something that you are not aware of, the tool will understand what it is.

184
00:19:09,980 --> 00:19:12,200
It depends what you want to take out of it.

185
00:19:12,200 --> 00:19:15,660
I mean, a segmented data is nice, but do you need the information to be current?

186
00:19:15,660 --> 00:19:26,520
If you need to manage something, if you need to be able to do something useful with the information that you uncover, you need this information to be real-time.

187
00:19:26,520 --> 00:19:28,840
And Active Network Discovery cannot be real-time.

188
00:19:29,520 --> 00:19:30,300
Yes.

189
00:19:46,040 --> 00:19:47,140
Exactly.

190
00:19:47,140 --> 00:19:48,020
Yes.

191
00:19:55,900 --> 00:19:57,020
Yeah.

192
00:19:57,360 --> 00:19:58,860
It's absolutely true.

193
00:20:00,320 --> 00:20:03,840
So, going fast to another area of invention.

194
00:20:03,840 --> 00:20:09,000
If you didn't know, Passive Network Discovery Systems were first introduced in the mid-1990s.

195
00:20:09,760 --> 00:20:13,420
Don't let other people tell you that they were invented last year.

196
00:20:13,940 --> 00:20:23,000
Basically, Passive Network Discovery System is merely a sniffer installed at the chock point of the network processing packets that were sent by active network elements on the network.

197
00:20:23,440 --> 00:20:25,500
That's actually one of its biggest problems.

198
00:20:25,500 --> 00:20:29,040
So, how can we look at the deployment?

199
00:20:30,780 --> 00:20:47,620
The system can be connected to the network using a tap, like this one, a span port, like this one, span port at the access layer, and span ports which are sent to one element.

200
00:20:47,620 --> 00:20:49,620
So, what kind of information can be harvested?

201
00:20:49,620 --> 00:20:53,180
Basically, the information is about active elements.

202
00:20:53,180 --> 00:21:09,300
Active elements that may have shown up in the inventory, active network services, the distances that those active network elements are from the monitoring point, the client-based software, the network utilization information, and, if possible, vulnerability information,

203
00:21:09,300 --> 00:21:11,560
if this passive network discovery tool is doing.

204
00:21:14,240 --> 00:21:34,620
The purpose of collecting the information would be to build the Layer 3 based topology, which is fairly problematic because what you need is actually the physical network topology, including the switches, including the hosts, to know exactly what you have and not just the Layer 3 one,

205
00:21:34,620 --> 00:21:46,660
the network utilization information, some network forensics, if the tool is able to do that, vulnerability discovery, to create some context about the network and to feed that information to other systems.

206
00:21:47,680 --> 00:22:11,360
The strengths of the system is merely the ability of the system to be real-time, to have no impact over the monitored network in the means that it doesn't send any type of traffic to the network and there it doesn't pose any kind of risk to the network when it runs on.

207
00:22:11,360 --> 00:22:20,840
It can process packets and can process information from all TCP IP layers and it can detect anything that is active on the network, even if it's for a short time period.

208
00:22:23,740 --> 00:22:41,760
It can also detect elements behind network obstacles, such as not-enabled devices, firewall elements, and also can provide you with network utilization information and can also be useful for network-related anomalies.

209
00:22:41,800 --> 00:22:47,320
Who is using a system that actually is based on anomaly detection?

210
00:22:48,640 --> 00:22:49,560
Cool.

211
00:22:49,560 --> 00:22:50,600
Are you happy with it?

212
00:22:50,600 --> 00:22:52,040
No, right?

213
00:22:52,100 --> 00:22:57,500
Because my anomaly is not your anomaly, it's not his anomaly, and that's the main problem.

214
00:22:58,520 --> 00:23:01,520
I'm not going to go into it, but I don't like it.

215
00:23:02,080 --> 00:23:03,120
Weaknesses.

216
00:23:03,200 --> 00:23:10,560
The first and biggest weakness of a passive network discovery system is that what you see is only what you get.

217
00:23:10,560 --> 00:23:20,860
So if you have an idle service, if you have an idle system, if you have an idle whatever, that kind of element, that kind of information will not be uncovered.

218
00:23:21,140 --> 00:23:26,840
If the information does not go through the monitoring point, it will not be uncovered.

219
00:23:27,640 --> 00:23:38,380
It means that at the end of the day, the discovery will be incomplete and inaccurate and non-granular because we cannot control what passes through the monitoring point.

220
00:23:38,380 --> 00:23:48,740
We cannot go to the client and say, you know what, we need you now to browse because we need the type of information that your browser sent to the network in order to build something or to conclude about something.

221
00:23:48,740 --> 00:23:50,980
We don't have any kind of control.

222
00:23:50,980 --> 00:23:52,640
We don't control the stimulus.

223
00:23:53,620 --> 00:24:01,740
So passive network discovery cannot detect all assets and cannot detect all protocols and services and cannot detect all ports.

224
00:24:01,740 --> 00:24:17,060
We cannot control what we see and in order for us to detect something, well, you know what, sometimes we cannot detect it because the kind of information that discloses the type of information that we need may never pass the monitoring point.

225
00:24:18,400 --> 00:24:24,510
So, another interesting subject.

226
00:24:24,510 --> 00:24:26,110
This is actually getting worse.

227
00:24:28,690 --> 00:24:30,010
Shut it off.

228
00:24:32,990 --> 00:24:34,030
Sorry?

229
00:24:39,280 --> 00:24:41,980
Where's the projector thing?

230
00:24:44,580 --> 00:24:46,280
You want to try this?

231
00:24:46,840 --> 00:24:47,840
Oh, he's recording.

232
00:24:47,840 --> 00:24:49,060
Yeah, you can do it.

233
00:24:50,020 --> 00:24:55,760
Nobody's here to press it, so just feel free to...

234
00:24:55,760 --> 00:24:59,340
Hey, it gets everything in all of those...

235
00:24:59,340 --> 00:25:01,260
Yeah, now we'll see...

236
00:25:01,980 --> 00:25:03,800
No, we don't want to do that.

237
00:25:05,320 --> 00:25:05,960
Sorry?

238
00:25:06,860 --> 00:25:07,540
Yeah.

239
00:25:14,440 --> 00:25:16,600
Okay, did you power it on?

240
00:25:16,600 --> 00:25:17,700
Okay, I'll continue.

241
00:25:17,700 --> 00:25:20,800
I have some modifications to the presentation of the problem.

242
00:25:21,600 --> 00:25:44,200
So, basically, when it tries to build the topology, what it will do, it will look at the distances the elements are from the monitoring point and it will look at the time to leave field value with the packets it receives and that actually would be the information that it will use in order to build the Layer 3 topology.

243
00:25:44,200 --> 00:25:45,220
And you know what?

244
00:25:45,220 --> 00:25:46,280
Guess what?

245
00:25:46,620 --> 00:26:11,960
That actually does not help me because if I see where the elements are and how are they located and what is their position according to my system, I cannot actually build everything because I will have islands of information and I will not be able to uncover the exact routers that are actually operating on my network.

246
00:26:11,960 --> 00:26:18,200
And the only thing that I will be able to detect is those systems that actually send traffic to the network.

247
00:26:19,660 --> 00:26:22,020
Okay, now this projector doesn't work at all.

248
00:26:22,020 --> 00:26:23,000
That's nice.

249
00:26:26,510 --> 00:26:28,290
It's always the messenger.

250
00:26:29,190 --> 00:26:30,030
Okay.

251
00:26:31,290 --> 00:26:36,810
So, if we have routing not done through the monitoring point.

252
00:26:36,810 --> 00:26:39,750
Okay, it seems to be trying to work.

253
00:26:40,090 --> 00:26:40,470
Wow

254
00:26:46,640 --> 00:26:47,340
.

255
00:26:47,440 --> 00:26:49,320
Yeah, it's encrypted stream.

256
00:26:53,940 --> 00:26:58,460
I'm not mirroring and it's 640x480.

257
00:26:58,660 --> 00:27:01,220
And I'll try to detect again.

258
00:27:01,220 --> 00:27:02,320
Oh, yeah.

259
00:27:02,940 --> 00:27:05,040
Refresh rate is down.

260
00:27:08,760 --> 00:27:10,460
Yeah, buy something else.

261
00:27:10,460 --> 00:27:11,760
That always works.

262
00:27:17,680 --> 00:27:18,420
Yeah.

263
00:27:39,380 --> 00:27:41,240
Yeah, I'll do that one second.

264
00:27:49,580 --> 00:27:50,240
Yeah.

265
00:27:50,340 --> 00:27:50,780
At

266
00:29:15,960 --> 00:29:19,060
least it works with Windows, right?

267
00:30:28,220 --> 00:30:29,820
See, I got an upgrade.

268
00:30:29,820 --> 00:30:31,200
So, now I'm using Windows.

269
00:30:34,530 --> 00:30:35,950
Thanks for the help.

270
00:30:36,050 --> 00:30:38,770
A round of applause for the guy that donated his machine.

271
00:30:42,660 --> 00:30:43,600
Yeah, I want it back.

272
00:30:43,600 --> 00:30:44,640
Okay, here it is.

273
00:30:44,760 --> 00:30:47,020
Should I go to JD Travel and see what's in it?

274
00:30:47,020 --> 00:30:47,500
Nah.

275
00:31:01,660 --> 00:31:02,300
Nice.

276
00:31:11,160 --> 00:31:12,440
Yeah, do it by telephone.

277
00:31:12,440 --> 00:31:13,460
That would be nice.

278
00:31:29,740 --> 00:31:30,380
Okay.

279
00:31:43,640 --> 00:31:45,180
Start from the beginning.

280
00:31:57,180 --> 00:31:58,680
At least you can see it now, right?

281
00:32:06,870 --> 00:32:07,510
Okay.

282
00:32:08,150 --> 00:32:17,010
So, basically, if this is my network and I want the passive network discovery system to draw it, this would be the result.

283
00:32:17,470 --> 00:32:18,590
Similar, right?

284
00:32:19,790 --> 00:32:22,090
I had this and now I've got this.

285
00:32:22,090 --> 00:32:24,910
The problem is that I wouldn't be able to uncover the switches.

286
00:32:25,270 --> 00:32:29,650
I would not be able to uncover which machine is connected to which switch.

287
00:32:30,130 --> 00:32:32,330
And at the end of the day, I get this thing.

288
00:32:32,330 --> 00:32:33,090
I have a router.

289
00:32:33,090 --> 00:32:33,830
I have systems.

290
00:32:34,410 --> 00:32:36,370
But actually, it's not my system.

291
00:32:36,370 --> 00:32:37,590
It's not my network.

292
00:32:39,630 --> 00:32:43,710
The problem is that we need to be deployed as close as possible to the access layer.

293
00:32:43,710 --> 00:32:46,910
We need to see latitude traffic.

294
00:32:46,910 --> 00:32:50,690
In order to do so, it means that we need a lot of moving boxes.

295
00:32:50,850 --> 00:32:58,330
And to do this in a complete coverage, it means a lot of boxes and a lot of moving parts.

296
00:32:58,330 --> 00:33:05,270
So, another weakness is that I'm unable to monitor the state of network services.

297
00:33:06,210 --> 00:33:09,110
If this is an idle service, I cannot monitor it.

298
00:33:09,110 --> 00:33:12,230
If the service goes down, I cannot monitor it.

299
00:33:12,590 --> 00:33:16,070
At the end of the day, no service monitoring.

300
00:33:16,270 --> 00:33:21,770
So, for example, I might see traffic for a certain port.

301
00:33:21,770 --> 00:33:23,710
I may declare it as an open.

302
00:33:23,830 --> 00:33:26,010
The guy would close the port.

303
00:33:26,010 --> 00:33:28,050
I will never know it.

304
00:33:28,650 --> 00:33:35,290
So, the less obvious weaknesses are the fact that I can inject whatever I want to the network.

305
00:33:35,290 --> 00:33:35,750
And guess what?

306
00:33:35,750 --> 00:33:39,090
The passive network discovery system will take it.

307
00:33:39,350 --> 00:33:45,630
The problem is that there is no way for the passive network discovery system to actually validate the information.

308
00:33:45,910 --> 00:33:51,430
This is since the only traffic it sees, well, goes through the monitoring point.

309
00:33:51,430 --> 00:33:52,550
It can't do anything.

310
00:33:52,550 --> 00:33:57,250
So, at the end of the day, that leaves it with the inability to validate it.

311
00:34:01,310 --> 00:34:06,950
The problem with it is that it's not only influencing the passive network discovery system.

312
00:34:06,950 --> 00:34:19,890
If there are other systems which rely on the type of information that the passive network discovery system actually provides in order to draw other conclusions, to do other things like network intrusion detection systems or even network intrusion prevention systems,

313
00:34:19,890 --> 00:34:23,710
that might be something which we don't want to be happening.

314
00:34:25,470 --> 00:34:44,350
This would actually cause the kind of information that will be taken from a passive network discovery system will cause other management systems that actually get the information from passive network discovery systems to produce even more inaccurate and incomplete information when they process the information the system provides them.

315
00:34:44,350 --> 00:34:49,530
A very simple example to show you how this works.

316
00:34:49,530 --> 00:34:53,030
Let's say we have a Windows-based machine like the one here.

317
00:34:54,190 --> 00:35:12,070
And a passive network discovery system might have some kind of counter or it might have some abilities to say, well, until I'm not detecting the operating system itself, I'm not trusting the information that actually is being sent through the different field values.

318
00:35:12,070 --> 00:35:18,450
So unless I understand that this is a Windows machine, I'm not going to trust the time-to-leave field value.

319
00:35:18,590 --> 00:35:22,750
So what I've done is that I only played with one field.

320
00:35:23,390 --> 00:35:25,370
I played with the time-to-leave field value.

321
00:35:25,370 --> 00:35:30,730
I changed it from default value of 128 to default value of 126.

322
00:35:30,930 --> 00:35:34,970
And all in all, that is still a valid Microsoft Windows machine.

323
00:35:34,970 --> 00:35:42,230
But for the passive network discovery system, it is now being located two hops down.

324
00:35:42,770 --> 00:35:44,410
I didn't do anything, actually.

325
00:35:44,410 --> 00:35:45,550
I didn't move it.

326
00:35:45,550 --> 00:35:50,690
I didn't have to actually physically disconnect it from the place that it is being connected to.

327
00:35:51,110 --> 00:35:58,550
This is because passive network discovery system, in this case, is unable to go to the switch and ask the switch, OK, who is connected to you?

328
00:35:59,710 --> 00:36:05,250
So a simple example to show you that it is very easy to trick the system.

329
00:36:05,250 --> 00:36:16,210
All you need to do is to understand the methodology and the way the system works in order to just put some decoys and deception and remove your system.

330
00:36:17,970 --> 00:36:27,590
Other weaknesses, denial of services, mainly because you need to take the information, open it up, and understand what you're seeing.

331
00:36:27,590 --> 00:36:30,250
Other examples of even remote code execution.

332
00:36:30,650 --> 00:36:38,530
Usually you will see this against Ethereal, which is a great tool, one of the best network analyzers out there.

333
00:36:38,630 --> 00:36:43,790
But some remote code execution is possible against it in its different versions.

334
00:36:45,330 --> 00:36:50,510
So, as some of you, I was in charge of a network and I had a problem.

335
00:36:50,790 --> 00:36:53,050
I had a problem that I couldn't understand what I have.

336
00:36:53,050 --> 00:36:55,070
I couldn't understand what I need to defend.

337
00:36:55,070 --> 00:37:02,390
I couldn't understand where are my elements so I can understand what are the differences that I need to do.

338
00:37:02,450 --> 00:37:07,290
I cannot build walls without understanding first what I need to defend.

339
00:37:07,930 --> 00:37:24,810
I've actually been doing this for the past several years and actually analyzed whatever there is to analyze regarding active network discovery, passive network discovery, and actually figured out that both of them will never help you if you want real intimate knowledge,

340
00:37:24,810 --> 00:37:27,510
complete and accurate about your infrastructure.

341
00:37:27,670 --> 00:37:42,570
Another interesting point is that there is many theoretical researches out there that actually they cannot be working on live environments, real world environments.

342
00:37:42,570 --> 00:37:47,570
If you remember the NAT researches, those are good for paper.

343
00:37:47,570 --> 00:37:51,590
They don't really work on the real world, unfortunately.

344
00:37:52,930 --> 00:38:11,850
So, the goals of the research were to have this kind of complete and accurate information, to have it in real time, to not have agents to detect and react to changes in real time, and basically not allow someone to send decoys that will be taken, but to understand that we have them and to ignore them,

345
00:38:11,850 --> 00:38:14,170
and to cover the entire IP address range of a network.

346
00:38:14,170 --> 00:38:18,550
And, of course, to have some other things like topology, which is really important.

347
00:38:19,190 --> 00:38:23,290
So, what I've come up to is with a technology called dynamic infrastructure discovery.

348
00:38:23,590 --> 00:38:30,870
Basically, this is a technology that combines, tightly integrates, actually, between active and passive network discovery.

349
00:38:30,870 --> 00:38:45,490
And by tightly integrating between them, it has new discovery abilities that are not able to be made with each and every one of those, if you use them solely.

350
00:38:47,270 --> 00:38:52,470
This technology, actually, is adjustable to any type of network that you are using.

351
00:38:52,470 --> 00:39:01,630
This is because it is able to balance between the information that is being harvested from a passive link to the amount of traffic it needs to send through an active link.

352
00:39:01,630 --> 00:39:07,750
It means that it works by listening to traffic that goes through a certain monitoring point on the network.

353
00:39:07,850 --> 00:39:15,390
It starts to build profile of the elements, data profile of the elements that are working on the network.

354
00:39:15,390 --> 00:39:35,270
And after a certain time had passed, and it seemed that some pieces of data that were not being collected, or there are some pieces of data that cannot be collected through using passive means, it's actually calling the active side and surgically inserting packets into the network in order to get the missing pieces of information.

355
00:39:35,270 --> 00:39:40,250
So, for example, if you want to know where your elements are, you need to talk to the switch.

356
00:39:40,250 --> 00:39:41,450
You can't do that passively.

357
00:39:41,450 --> 00:39:46,430
Or if you want to validate the type of information that you've seen passively, you do that actively.

358
00:39:46,810 --> 00:39:55,230
So at the end of the day, it balances between the type of information that it sees going through the monitoring point, which can be good, can be bad, and can be great.

359
00:39:55,230 --> 00:40:00,990
It all depends on the time of the day that you operate on or that you are at.

360
00:40:00,990 --> 00:40:07,350
For example, when your users are coming to work, 8 o'clock, 9 o'clock, everything is working, right?

361
00:40:07,350 --> 00:40:10,710
They do email, they browse the web, everything is fine.

362
00:40:11,450 --> 00:40:14,630
12 o'clock, everybody at lunch, nothing works.

363
00:40:15,070 --> 00:40:16,890
6 o'clock, everybody works.

364
00:40:16,890 --> 00:40:23,330
A lot of elements basically disappear from the network because people shut down their machines and go home.

365
00:40:23,590 --> 00:40:27,670
2 a.m., you might see a lot of backup activity on a network.

366
00:40:27,670 --> 00:40:34,770
So at different times of the day, you see different things on a network that you are able to take different things from them about the elements.

367
00:40:34,770 --> 00:40:38,190
But at the end of the day, you need that information to be complete.

368
00:40:38,190 --> 00:40:42,210
So the balance comes from using the active site, surgically probing.

369
00:40:43,610 --> 00:40:57,230
Other things that are unique, for example, you can detect what are the guest machines of a certain host machine of VMware or any virtual machine.

370
00:40:57,270 --> 00:40:58,950
You are able to tie them together.

371
00:40:59,130 --> 00:41:04,150
It's easier to detect not-enabled devices and wireless access points using this technology.

372
00:41:04,150 --> 00:41:14,130
Basically, any piece of information that can be gathered either passively or actively can be gathered using this technology.

373
00:41:16,050 --> 00:41:19,730
You can build your asset management.

374
00:41:19,730 --> 00:41:32,450
You can do physical network topology because you are able to take the information that comes from the passive site, combine it with the information you are able to take from the switches and combine them into physical network topology where you show where the hosts are actually connected,

375
00:41:32,450 --> 00:41:35,030
the switch connectivity and the routers.

376
00:41:35,030 --> 00:41:37,290
This is something that you can actually work with.

377
00:41:37,850 --> 00:41:39,470
You have a real-time change detection.

378
00:41:39,470 --> 00:41:44,130
You operate in real-time because you have that from the passive site.

379
00:41:44,130 --> 00:41:51,930
You don't require any agents to be installed on the machines because your monitoring point provides you with all the information in the world that you have.

380
00:41:54,450 --> 00:41:56,490
I already talked about this.

381
00:41:57,710 --> 00:42:03,550
One of the things that I like about this is that you are able to triangulate between user, host and location.

382
00:42:03,550 --> 00:42:16,270
One of the biggest problems of managing and securing enterprise network is the inability to locate or the inability to say who is the exact user that is actually doing this and where actually his machine is being located at.

383
00:42:16,270 --> 00:42:33,010
So when you have the physical location information, when you have the host name and you have the user name of the actual user that's actually been using this, it's very easy to come to someone and say, you are the one that actually did this and that because you have all the information that triangulates that user to his machine.

384
00:42:33,950 --> 00:42:51,290
From using only surgical probing, this technology does not pose any kind of risk to production environment because you do not need to use a lot of packets in order to probe elements on the network for getting the information from.

385
00:42:51,290 --> 00:42:59,350
And therefore, all the information is being either harvested passively or by using surgical active packets.

386
00:42:59,350 --> 00:43:02,970
So the number of packets they actually insert into the network is very low.

387
00:43:02,970 --> 00:43:08,790
The packets are RFC compliant and there is no risk of using those against production environments.

388
00:43:10,910 --> 00:43:12,690
Some limitations.

389
00:43:12,690 --> 00:43:20,350
The only limitation that this technology actually have is that you can't really scan a network for 65,000 something ports.

390
00:43:20,510 --> 00:43:26,490
So you might not uncover all the services that are actually working on that system.

391
00:43:26,610 --> 00:43:27,850
Some usages.

392
00:43:28,390 --> 00:43:31,030
I'm being brief because I need to finish.

393
00:43:31,670 --> 00:43:35,030
You have clear visibility into your infrastructure.

394
00:43:35,030 --> 00:43:44,350
Everything that is on the network is being detected from storage devices to host machines to network-enabled, not-enabled devices to wireless access points, everything.

395
00:43:44,350 --> 00:43:54,690
The accuracy level of the technology, let's say when we're doing OS detection, is less than 0.25% of false positives.

396
00:43:54,690 --> 00:44:06,710
The ability to locate any device on the network, see its properties, see its whereabouts, understand what is being done in real time is something that you need as a context.

397
00:44:07,070 --> 00:44:10,890
And when you have physical network topology, you can locate everything.

398
00:44:11,030 --> 00:44:19,870
And when you have all this information that allows you to see whatever everybody or that particular element is doing, you are able to understand what is happening.

399
00:44:19,870 --> 00:44:22,690
And if there is a problem on the network, you are able to locate it easily.

400
00:44:22,690 --> 00:44:28,350
So let's say that you are an admin and there is a new patch for a certain service.

401
00:44:29,650 --> 00:44:37,330
Usually what you'll do is you'll scan your network and understand where it is and try to understand what are the services that need to be patched first.

402
00:44:38,090 --> 00:44:48,190
When you have current and real-time information, what you only need to do is just to have a search under your inventory for the open port.

403
00:44:48,630 --> 00:44:49,970
You get the list instantly.

404
00:44:49,970 --> 00:44:54,590
So you save the IT hassle of going and looking for that type of information.

405
00:44:54,590 --> 00:44:57,490
You instantly have the information that you need in order to work against.

406
00:44:57,490 --> 00:44:59,690
And that saves you a considerable amount of time.

407
00:45:00,570 --> 00:45:04,550
You can take the information and feed it to other systems.

408
00:45:05,870 --> 00:45:09,250
For example, you can do target-based vulnerability assessment.

409
00:45:09,250 --> 00:45:16,390
One of the biggest problems of vulnerability assessment tools is that they need to do active network discovery.

410
00:45:16,390 --> 00:45:25,870
So what you do is you're able to take a list of your Windows machines or Windows 2000 machines and instantly feed it to a vulnerability assessment tool.

411
00:45:25,870 --> 00:45:33,490
And that vulnerability assessment tool may need to do only the Windows 2000-based test against those machines.

412
00:45:33,490 --> 00:45:34,730
And that's it for it.

413
00:45:34,730 --> 00:45:46,030
So you actually are able to make those tools work better and solve the 80-20 problem for them by feeding them with contextual information about the network.

414
00:45:46,030 --> 00:45:53,330
There's also the ability to baseline the knowledge about the elements that operate on the network because you see them all the time.

415
00:45:53,330 --> 00:45:59,470
So you're able to actually say what's unauthorized and what's not authorized because you see everything.

416
00:46:00,010 --> 00:46:12,610
Until this point, if you're using an active tool, like this gentleman had said, if I do a scan once in 24 hours, I can't do anything with the information because I don't see the changes.

417
00:46:12,610 --> 00:46:19,530
There are some users that might bring their laptops from home and take it in between, and I'll never know that they're actually existing.

418
00:46:22,910 --> 00:46:31,510
I think the most important thing about the technology, about the dynamic infrastructure discovery technology, is that you finally have control.

419
00:46:31,510 --> 00:46:44,810
You can achieve control of what you have because you understand what you have, you understand the layout, you understand you have strong auditing capabilities, and you understand to use it for the first time and not just saying, okay, I have partial information,

420
00:46:44,810 --> 00:46:47,910
I have complete information, I have control, I have everything that I need.

421
00:46:49,190 --> 00:46:49,990
Questions?

422
00:46:50,850 --> 00:46:52,650
Yes, the gentleman here.

423
00:46:56,060 --> 00:46:57,220
This is working.

424
00:46:57,220 --> 00:47:00,760
If you want more details, I'll give it to you at the end of the presentation.

425
00:47:01,580 --> 00:47:02,540
Other questions?

426
00:47:07,280 --> 00:47:10,760
If you'll talk to me after the presentation, I'll answer the question.

427
00:47:11,580 --> 00:47:12,460
Yes.

428
00:47:23,650 --> 00:47:27,230
The only switches that you actually know that they exist are your core switches.

429
00:47:27,230 --> 00:47:39,610
I mean, in all the companies that I was talking to or working at or consulting to, what they know is they have a firewall that connects them to the Internet, and they have those nice core switches because they cost them a lot of money.

430
00:47:39,850 --> 00:47:45,930
And usually when you hook this up to the core switch, you get all the information that you need from the core switch and you go from there.

431
00:47:45,930 --> 00:47:57,790
Sure, it's something that you need to install on X number of places in a distributed manner in order to see the complete visibility because it needs to see traffic between Layer 2 to Layer 3.

432
00:47:57,950 --> 00:48:01,510
But at the end of the day, you still see complete visibility.

433
00:48:01,510 --> 00:48:06,970
Say that you want to have an IDS system, an IPS system, they all have the same problem.

434
00:48:07,770 --> 00:48:15,190
But this system actually can take traffic from multiple networks into one place and not just see one network at a time.

435
00:48:17,730 --> 00:48:23,350
If you have a Layer 3 barrier that you cannot pass, you need to install another system.

436
00:48:27,970 --> 00:48:33,990
Well, when you have a management server, you are able to connect everything and all the dots and you have complete information about everything.

437
00:48:35,590 --> 00:48:36,550
Yes.

438
00:49:22,620 --> 00:49:29,760
You must use SNMP to take information from the switches because there is no other way to understand where the elements are if you are not using SNMP.

439
00:49:29,760 --> 00:49:36,440
The idea is that you don't need to know the connectivity and you build the connectivity automatically using other algorithms.

440
00:49:36,440 --> 00:49:47,020
There are several researchers that were talking about how you build your topology by just taking the information from the switches and trying to connect the switches without using proprietary protocols.

441
00:49:47,020 --> 00:49:49,680
Some of them have some holes in it.

442
00:49:49,760 --> 00:49:51,780
Some of them are incomplete.

443
00:49:51,780 --> 00:49:55,220
But at the end of the day, you can learn a lot from those researchers.

444
00:49:56,980 --> 00:50:03,380
What I did with this technology is you must understand where the elements actually are connected to.

445
00:50:03,380 --> 00:50:12,640
And what you are able to do is just to say, okay, if this element is something that, for example, is unknown, I am able to say which switch and which switch port is actually being connected to.

446
00:50:12,640 --> 00:50:17,820
You can use that information and you can say, okay, now I won't go and tell the SSH and kill this port.

447
00:50:17,920 --> 00:50:20,640
The idea is to have the visibility.

448
00:50:21,080 --> 00:50:34,440
There are some switches that can send you an SNMP trap, for example, when the information about the source MAC that is being registered to the port changes.

449
00:50:35,700 --> 00:50:37,280
Not all of them are able to do that.

450
00:50:37,280 --> 00:50:40,580
The new Cisco 2950 are able to do that.

451
00:50:40,580 --> 00:50:44,600
But at the end of the day, if you want to start to do log aggregation, be my guest.

452
00:50:44,600 --> 00:50:50,820
I mean, there are other products that do log aggregations and other open source tools.

453
00:50:50,820 --> 00:50:55,080
But if you don't know what you are doing with the information, then it's just a big pile of logs.

454
00:50:57,600 --> 00:50:58,400
Yes?

455
00:51:03,380 --> 00:51:04,600
You said what?

456
00:51:05,920 --> 00:51:08,800
Yes, it is possible in several cases to detect subs.

457
00:51:10,200 --> 00:51:17,920
Basically, the issue is that if you have a port which you see multiple MAC addresses and is not connected to any other switch, then guess what?

458
00:51:17,920 --> 00:51:19,100
You have a hub.

459
00:51:19,100 --> 00:51:24,760
Of course, it might be a 4 port or a 6 port or a 16 port, but no more than that.

460
00:51:24,860 --> 00:51:26,180
A hub is merely a guess.

461
00:51:26,180 --> 00:51:31,120
But if you don't have any other switch connected to that port, you basically have a hub there.

462
00:51:32,700 --> 00:51:33,860
Of course.

463
00:51:33,860 --> 00:51:41,480
You must be connected as close as possible to the access layer in order to do anything in networking and security these days.

464
00:51:41,920 --> 00:51:42,820
Yes?

465
00:51:58,960 --> 00:52:02,400
If you are using TTL, it means that you are going to fail.

466
00:52:02,540 --> 00:52:06,700
That's something very easy to change and you don't want to use that.

467
00:52:06,700 --> 00:52:09,920
Look at the example that I put here.

468
00:52:10,700 --> 00:52:13,300
You have two ways of doing that.

469
00:52:13,300 --> 00:52:16,500
You have a bridge mode and you have a NAT mode.

470
00:52:16,700 --> 00:52:20,700
Both of them, you need to have different ways in understanding that you have VMware.

471
00:52:20,700 --> 00:52:26,000
I mean, it's very easy to understand that an element is a VMware machine just by looking at the MAC address and it's VMware, right?

472
00:52:26,200 --> 00:52:35,660
But the thing that you need to do is that you need to actually understand where it is being connected to and that's other algorithms that I'm using to do that.

473
00:52:37,160 --> 00:52:40,160
Okay, so they need to... yeah, one other question.

474
00:52:45,670 --> 00:52:46,550
No.

475
00:52:47,910 --> 00:52:51,950
This works against whatever you put and if you have VLANs, that's not a problem.

476
00:52:52,210 --> 00:52:56,030
If this wasn't working with VLANs, then I guess it was a major problem.

477
00:52:56,270 --> 00:52:59,190
It is working with VLANs with everything they have on the network.

478
00:53:00,950 --> 00:53:06,390
So, I would like to thank you that you have stayed with me through all of the problems that we had today.

479
00:53:06,390 --> 00:53:09,050
Starting late, replacing laptops.

480
00:53:10,950 --> 00:53:13,810
And staying up until 5 minutes to 9 p.m.

481
00:53:13,810 --> 00:53:15,350
Thank you very much for having me here.

482
00:53:15,350 --> 00:53:16,410
I enjoyed this.