topic Re: IDSM handling IP Spoofing in Network Security

IDSM handling IP Spoofing

szekahungdanny — Sun, 10 Mar 2019 12:12:02 GMT

anyone know IDSM could detect IP Spoofing ?

currently, we have set mirroring entire vlan traffic into IDSM. All workstations under same VLAN.

Within the VLAN, always having duplicated IP happened. and we concern is it IP spoffing happened on the network.

I try to simulate the situation...We set 2 workstaions with same IPs but different MAC addresses.

Normally, pc would get duplicated IP address conflict. Would IDSM could sense this? However, I fail to get any event for this in IDSM.

Any suggestion to simulate the situation? and did IDSM support detecting IP Spoofing?

Re: IDSM handling IP Spoofing

mirober2 — Thu, 09 Dec 2010 19:39:02 GMT

Hello,

I would suggest moving this question over to the IPS/IDS community, the experts there will have a better answer for you:

https://supportforums.cisco.com/community/netpro/security/intrusion-prevention

You can also check the product documentation here:

http://www.cisco.com/en/US/products/hw/modules/ps2706/ps5058/tsd_products_support_model_home.html

-Mike

Re: IDSM handling IP Spoofing

szekahungdanny — Tue, 14 Dec 2010 10:41:37 GMT

Any update?

Re: IDSM handling IP Spoofing

Christopher Dreier — Mon, 07 Feb 2011 19:44:49 GMT

Hello szekahungdanny,

This would require the IDSM-2 to maintain a table of IP/MAC correlation. This is not a function of the IDSM. What you are looking for is the ip source guard feature of the Catalyst switches: http://www.cisco.com/en/US/partner/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/ipsrcgrd.html

Please let me know if I can help you with anything further within the context of this thread. If your question has been Answered, please mark the thread as such so that it will be helpful to other users. Also, please feel free to Rate this thread to reflect your experience.

Thank you,
Blayne Dreier
Cisco TAC Escalation Team

**Please check out our Podcasts**
TAC Security Show: http://www.cisco.com/go/tacsecuritypodcast
TAC IPS Media Series: https://supportforums.cisco.com/docs/DOC-12758