Impersonation watch
Treats LLDP, CDP, mDNS, SSDP and NetBIOS as claims, and raises a High alert when a device poses as a switch, phone, access point, gateway or another device.
Detect · Branch tripwires
Unplugged before the next poll still counts.
Catches a link that came up and went down between polls, any link on jacks you arm, and anything connected while a branch is closed, dated by the switch’s own clock.
The problem
Plugging in briefly between two polls is the first thing a red team tries against any tool that polls.
A drop at a branch after closing time is the standard physical test at a community bank.
How it works, illustrated
What this shows
Branch 3's day on a Thursday, with its site hours, Monday to Friday 8:00 AM to 5:30 PM in the branch's own time zone. At 6:45 PM, after closing, a link changed on the lobby jack, SW-B3 Gi1/0/22. Zoomed to 6:40 to 6:50 PM: the switch is polled every two and a half minutes. At the 6:43:30 poll the link was down. At the 6:46:00 poll it was down again, but the switch's ifLastChange had moved to 6:45:31 PM and its in-octet counter had risen, so a device was plugged in and removed between the two polls. When the link came up is not known, and the drawing marks that span as unknown. The appliance raises a High alert, after_hours_link, dated 6:45:31 PM by the switch's own clock, and writes a tripwire_tripped entry carrying the switch's readings: sysUpTime, ifOperStatus, ifLastChange and ifHCInOctets.
appliance tripwires -data-dir /var/lib/appliance -since 720h -site "Branch 3"# trips from the last 30 days as formula-safe CSV, for a SIEM,# a file share or a spreadsheet; add -armed to list the armed jacksTrips arrive as alerts in every configured destination, and export as CSV or JSON.
The Tripwires page, with trips by rule and site, time to detect and armed jacks, is designed and arrives with the new interface.
How it works
- Each switch poll also reads every port’s last-change time and traffic counters. A link that came and went between polls is caught and dated by the switch’s own clock, not by when the appliance noticed.
- Arm the dark jacks in lobbies and conference rooms. Any link on an armed jack is a High alert, followed by one quick re-poll to read the MAC address while it is still plugged in.
- Set each site’s opening hours, closed days and holidays in its own time zone. Anything connected while a site is closed is a High alert.
- A link that is up and passing traffic with no address learned is flagged as a silent link.
- Time to detect is reported as the median, the 95th percentile and the maximum.
- Arming jacks and changing hours need an Admin, a reason and a code. Resolving a trip needs a Reviewer, a reason and a code.
What it proves
Each trip carries the switch’s own readings, so an examiner can check “it went down at 14:12:07” against the switch’s numbers. Every arming, hours change and resolution is signed and logged under a name.
What it records
Entries this feature writes to the tamper-evident audit log. Each one is in the evidence packs that cover its date.
- tripwire_trippedThe rule, the port, and the switch readings it rests on: uptime, link state, last change and counters.
- tripwire_armedWho armed a jack, and why. tripwire_disarmed records the reverse.
- witness_changedWhen a switch’s change counters become unreliable, and when they recover.
Limits
What it does not do yet, stated plainly. The technical page lists every known gap.
- The page is not built yet.
- Tripwires follow a port’s interface index, which can renumber on equipment without persistent indexes.
- A listen-only sniffer or an inline tap does not show in these counters.
- There is no SNMP trap receiver yet, and the simulated switches in the demo cannot show a live trip.
Technical detail
Early access: now taking pilot customers.
See it on your own network.
A live demo with the engineers who built it. We bring a simulated network; you bring your questions.