Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to detect an unauthorized switch on a LAN? My university IT department does not permit people from attaching their own switches to the network. I am interested in knowing if it is actually possible to detect them and circumvent detection?

Does a virtual Machine with bridged network connections make the host machine look like a switch? How can once analyze the traffic from a port to know if there is a switch downstream or if they are just virtual machines? I could change my physical machine MACs (first 3 octates) to be in the range of virtual machines, if MAC is the only way to distinguish switches from a VM.

share|improve this question
up vote 1 down vote accepted

Using managed switches or a system like arpwatch, it is capable to monitor all traffic on the network for MAC addresses. You can then enforce that only one MAC address be routed to each port on the managed switch equipment. When a switch was used outside of your network, you would notice because there would be too many (>1) MAC addresses routed to a given port.

A virtual machine bridge would still look this way because there is more than one address on a given port, but a virtual machine configured in a NAT configuration would not, since all traffic would go through the host machine. What the MAC address properties say is not really the issue, it's the number of addresses in the ARP table for a given place.

Is your university using such a system? depends on a lot of factors. I would tend to guess that they're not, just because this kind of setup takes time and effort to implace. They may, though. If your university uses RADIUS authentication then this would definitely be a road block, since the RADIUS server is tracking objects my MAC address and thus would see each thing on the switch as a different client, so they'd all need to be authenticated separately.

share|improve this answer
My university does not use RADIUS on the wired LAN - plug in and you are connected. Bridged network on VMs work just fine. I am inclined to believe that the only thing they have in place is an 'Operational Policy' to stop switches from being connected. If they see too many MACs or an unauthorized WiFi AP, they come over to physically investigate and take the MAC address to create a script. – Lord Loh. Aug 25 '12 at 21:48

if you would connect a switch this would mean that you would have more than one mac address talking to the network, this can be locked down on enterprise switches like cisco's

even if you bridge a VM it would need another mac address and the same story would apply

share|improve this answer
Bridged networks have never been a problem for me. – Lord Loh. Aug 25 '12 at 21:49

I believe nmap can tell someone what is connected to the network and whether it is a switch or router or Pc. You might check the documentation to see if it can be fooled by spoofing the mac.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .