Forest Global Training Partners

Cyber Risks · Cisco Talos

Power over Ethernet and Snort

Summary: Cisco Talos researchers describe trying to place a Snort sensor inline with a PoE-powered wireless access point, and failing at first because the sensor could not supply power and the access point drew phantom power over the data pairs (1, 2, 3 and 6). They succeeded by using a VoIP phone dongle that moves power to the free pairs (4, 5, 7 and 8) and passes the 802.3af 25K ohm powered-device check, then wiring a four-port patch panel with a seven-dollar punch-down tool to route power around the sensor while data passed through it.

Key Takeaway: The workaround hinged on a 25K ohm resistance check in 802.3af: any inline device that does not present it gets no power at all, which is why the sensor could not simply sit in the line. The team also notes it NOPed out checks in Snort to allow an overly long content replace, a reminder that getting full traffic visibility sometimes means weakening the sensor itself.

Read the original at Cisco Talos ↗

Topics
Malware
Related