Network segmentation

[Fida jlassi]

Hi,

Is there a way to test the network segmentatation ( procedure, tool...) , in order to check the security vulnerabilities in the network (the network is based on the Cisco infrastructure)?

[chris noon]

You could use a network/IP scanner in order to test what IP address can be reach on what ports from a specific point in the network.  

However be very careful as these types of tests can saturate your network.

[Fida jlassi]

Could you please explain more. for example I have two networks 192.168.141.0/24 and 192.168.142.0/24 how can I test the network segmentation ?

[chris noon]

I will try to expand a little further.

Use a server or a laptop and place it into network 192.168.141.0/24.  Give it an IP address in the same range.

Use an network/IP scanner and scan all ports on network 192.168.142.0/24.  This will show you each IP address that is reachable and what ports they are reachable on.

If you find a good network/IP scanner you can get it to alter the source address as well so it will test all source addresses against all destination addresses giving you a complete network to network permission list.

[Fida jlassi]

Thanks for the clarification, could you please give us the name of the network/IP scanner.