ARP атаки на 5.1, +пассивный сниффер. Опции

[RecOll]

Ну, добрый вечер.
Странно, почему подмену мака у 192.168.5.1 так сложно заметить?
Смотрите логи (IP и MAC нападавшего, не ужели так сложно вычислить? У вас что, логии не ведутся, или просто не просматриваются?). Вот точное время подмены мака у 5.1:
с 5 дек 23:35:05 по 6ое...
...
с 7го 22:11:15 до 22:35:45 (после этого инет упал на 15 минут)

2) Сегодня было ещё 2 признака пассивного сниффера.
Всё бы хорошо, но не Пси ли должно этим заниматься?
Мало того, что любой, вооружившись нехитрыми прогами легко и незаметно может вырубить инет, так ещё и снифферить ?

ПРИМИТЕ МЕРЫ!

[bone]

В пятой сети пока такое возможно. Никакие логи не помогут. В ближайшее время сеть будет переверена на безвпнную работу с привязкой на порту коммутатора.

[root]

А почему по пассу с 5 сети можно войти с 7 в инет?
Это вообще очень интересно.. Как же шлюз?

[olegy]

Цитата: А почему по пассу с 5 сети можно войти с 7 в инет? Это вообще очень интересно.. Как же шлюз?

Рут, ты запарил нафиг 8-)

[Fury]

Цитата: В пятой сети пока такое возможно. Никакие логи не помогут. В ближайшее время сеть будет переверена на безвпнную работу с привязкой на порту коммутатора.

позвольте вопрос уважаемые... ))
а в 15 и 16 подсетях это возможно??
просто очень похожие признаки проявляюцца.... :?

[bone]

Цитата: а в 15 и 16 подсетях это возможно??

Да.

[Fury]

Цитата: Цитата: а в 15 и 16 подсетях это возможно?? Да.

ясна...
я так понимаю, что юзеры с этим бороцца не могут... :( и решаецца эта проблема тока на пси-техническом уровне... так? )

[bone]

Да. Заменой оборудования.

[Rombo]

Цитата: Да. Заменой оборудования.

вы можете обезопасить хотя бы тех пользователей, которые уже подключены через такое оборудование ?

[bone]

В ближайшее время все будут подключены (в 5-й сети).

[RecOll]

Всё по прежнему: (31-1го инет падал из-за очередной подмены)

Код

Dec 31 21:25:44 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:29:14 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:29:19 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:30:11 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:30:12 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:30:14 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:30:14 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:33:19 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:33:20 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:33:22 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:33:24 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:37:01 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:37:02 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:37:04 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:37:04 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:41:20 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:41:20 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:41:23 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:41:31 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:43:32 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:43:34 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:43:35 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:43:38 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:44:58 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:44:59 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:45:01 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:45:03 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:52:32 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:52:32 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:52:56 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:52:58 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:53:21 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:53:25 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:53:45 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:53:46 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:54:08 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:54:11 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:54:32 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:54:32 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:55:19 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:55:24 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:55:43 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:55:43 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:56:06 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:56:11 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 21:56:51 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 21:56:52 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:00:05 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:00:11 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:01:47 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:01:48 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:01:50 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:01:52 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:02:59 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:03:03 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:15:28 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:15:30 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:15:31 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:15:32 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:21:09 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:21:09 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:21:12 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:21:13 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:23:10 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:23:11 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:23:13 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:23:14 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:23:23 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:23:25 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:25:37 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:25:38 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:25:39 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:25:43 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:28:43 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:28:50 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:40:43 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:40:44 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:40:46 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:40:46 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:43:47 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:43:48 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:43:54 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:43:59 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:44:35 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:44:36 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:44:38 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:44:40 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:47:07 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:47:07 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 22:47:09 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 22:47:10 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:04:54 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:04:55 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:04:57 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:05:03 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:05:46 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:05:46 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:05:49 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:05:49 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:06:33 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:06:35 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:07:14 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:07:20 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:08:18 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:08:19 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:08:21 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:08:22 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:11:00 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:11:01 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:11:03 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:11:04 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:18:00 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:18:04 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:22:11 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:22:12 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:22:14 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:22:17 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:24:43 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:24:44 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:24:46 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:24:48 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:26:51 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:26:52 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:26:54 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:26:55 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:41:53 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:41:54 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:41:56 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

Dec 31 23:41:56 u53 kernel: arp: 192.168.5.1 moved from 00:30:48:12:63:51 to 00:80:48:28:62:16 on rl0

Dec 31 23:49:34 u53 kernel: arp: 192.168.5.1 moved from 00:80:48:28:62:16 to 00:30:48:12:63:51 on rl0

...

и т.д.

[AlxsDfndr]

РУКИ б ОБРВАТЬ этому УРОДУ-подменьшику!! :evil: :evil: :evil:

P.S. r10 это -- 5.10 :?:

[Fel]

Заблокал порт.

[root]

Хм... Бедняга.

[Fel]

Думаю до тебя ему далеко...

[jihor]

А сегодня (5.01.05) опять падал (с 16.00 до 17.00)?

[Fel]

Цитата: А сегодня (5.01.05) опять падал (с 16.00 до 17.00)?

По другой причине(работы с биллингом). Только зере не говорите а то злой, всех порвет..

[olegy]

Цитата: Цитата: А сегодня (5.01.05) опять падал (с 16.00 до 17.00)? По другой причине(работы с биллингом). Только зере не говорите а то злой, всех порвет..

Типа хакеры, пропишите на своих гейтах mac для 5.1 перманентно. Всё будет пофиг.