GHOST NETWORK DETECTED!





Will actually in theory on switched networks each portion of a LAN is independent. This means that for instance that network 192.168.1.0/24 and 192.168.2.0/24 are using different switch ports that communicate through a router,  and also that are not sharing the same physical network. Unfortunately sometimes people violate this principle by putting on the same physical port multiple networks.

The reasons are manyfold:

·         You want to run a VM on your host that can (silently) communicate with other devices and thus you want to use a different network address plan.
·         You use devices that have an embedded switch (e.g. Apple Airport Time Capsule NAS device) to which you connect both your PC (with a publicly accessible IP address) and the backup device that is not supposed to be accessed from the Internet and thus living on a different network.
·         Some of your colleagues are trying to hide some devices and thus are decided to use a network other than the one used on the LAN.
·         You migrated your network to a different addressing scheme but you forgot to update some devices that are still configured with the old network.
·         Somebody attached (without configuring it) a new device just purchased that is then using a different network address.


So in essence there are many reasons ranging from misconfiguration, to malicious users who attach devices to the network hoping not to be discovered. Fortunately moderns devices are rather verbose and advertise their presence for instance through MDNS (Multicast DNS), IPv6 advertisements, and for sure ARP on IPv4 networks.

Comments