Branch tripwires
Catches a link that came up and went down between polls, any link on jacks you arm, and anything connected while a branch is closed, dated by the switch’s own clock.
Detect · Impersonation watch
A device that says it is a switch is not believed.
Treats LLDP, CDP, mDNS, SSDP and NetBIOS as claims, not trust, and raises a High alert when a device poses as a switch, phone, access point, gateway or another device.
The problem
Most MAC-table tools believe what a device says about itself. One forged LLDP frame saying “I am a switch” can turn a desk port into an uplink, and everything behind it goes quiet.
A cloned gateway MAC address can be treated as network plumbing wherever it appears. Both are standard checks in a penetration test.
How it works, illustrated
What this shows
Two of the impersonation rules, using tables the appliance already polls. Rule 1: a laptop on SW-B3 port Gi1/0/22, a desk port, sends an LLDP frame saying it is a switch, with chassis 00:00:5E:00:53:2A. Nothing vouches for the claim: there is no confirmed neighbor on that port, and believing it would turn a desk port into an uplink. So the claim is refused, the port stays a desk port, and the devices behind it stay in the inventory. The appliance raises a High rogue_switch alert, holds the port out of bulk sign-off, and says how to fix it: confirm the neighbor if it is real, or find the device. Rule 2: the MAC address 00:00:5E:00:01:01, a VRRP virtual router MAC that a gateway uses, is learned on SW-B3 port Gi1/0/9, another desk port. Gateway MACs belong on uplinks and hypervisor ports, so it is not hidden as network plumbing. The appliance raises a High gateway_impersonation alert, with hardening to run by hand: port security, DHCP snooping and dynamic ARP inspection on that VLAN. The appliance never changes a switch.
Findings arrive as alerts with the reason and, where there is one, the hardening command to run by hand.
The dedicated screens, an Impersonation tab on Alerts and a Confirm neighbor form, are designed and arrive with the new interface.
How it works
- A neighbor that claims to be a switch, router, phone, access point or hypervisor is not believed if the claim would change the port’s class and nothing vouches for it.
- A switch claim that uses a monitored switch’s identity is checked against that switch’s own neighbor table. No match is a High alert.
- A gateway’s virtual MAC (VRRP, HSRP or GLBP), or a network device’s MAC, learned on a desk port is a High alert.
- A network device’s address, or an approved device’s address, answering from another MAC is a High alert.
- A desk port carrying more VLANs than a desk uses is a High alert.
- A held device can never be approved in bulk or in the weekly sign-off. A person deciding it alone, with an authenticator code, still can.
- It uses tables already polled. No new reads, and it never changes a switch.
What it proves
Nobody can sign off an impostor with one code, because held devices are kept out of bulk approval. Confirming a real neighbor is a signed log entry an examiner can read, and the alert kinds are stable names a SIEM rule can match.
What it records
Entries this feature writes to the tamper-evident audit log. Each one is in the evidence packs that cover its date.
- alert_raisedrogue_switch, neighbor_disguise, identity_conflict, gateway_impersonation, ip_takeover or trunk_on_edge.
- neighbor_confirmedAn Admin’s signed statement that a real phone, access point, hypervisor or switch is on a port. neighbor_revoked withdraws it.
Limits
What it does not do yet, stated plainly. The technical page lists every known gap.
- The screens are not built yet. Today findings appear as alerts and through the data routes.
- Hardening commands are written in Cisco syntax only.
- False-positive rates on real equipment are not measured yet.
- ARP poisoning that never reaches a polled router cannot be seen over SNMP.
Technical detail
Early access: now taking pilot customers.
See it on your own network.
A live demo with the engineers who built it. We bring a simulated network; you bring your questions.