Notification when hostile device in network (port security)

Question

I was wondering if there was a way, that whenever a hostile device (unknown device, like a wireless router a personel member brings to the office) this would be notified to a central system with the switch on which it occured and what port.

I know you can shut down ports with port security, but is there a way there would also be an immediate notification ?

Answer 1

A network intrusion detection device should be able to do this for you.

A simple one-off utility is arpwatch, which will alert you to any changes (including additions) in MAC to IP address mappings.

Answer 2

802.1x can provide both port security (only allowing authorized computers) and can report unauthorized connections. You should be able to leave it in "test" mode (most implementations call it that when they allow traffic regardless of successful/failed authentication) and simply monitor the logs/reports.

Answer 3

Probably over thinking this on my part, but you could write a script scan the network with the nmap tool to scan the entire network, log new entries, and block them.

Answer 4

The big question is: What is a "hostile" device? There are a lot of different strategies to implement this:

• You can configure some switches to send SNMP traps when an unknown MAC address has been connected.
• You can configure your switch to only be open for DHCP until the DHCP server gives a DHCPACK (the exact term of this technology escapes me). You can then control access on the level of the DHCP server (i.e. linking to an Asset Management system to see whether the MAC address is known to the company).