Catch network poisoning

What the attack is

When a Windows computer can’t find a name in DNS, for example after a typo like \\fileserv, it falls back to asking the whole local network: “who is fileserv?”. These questions use LLMNR and NBT-NS, two old name-lookup methods that are still on by default.

An attacker inside your network can simply answer “that’s me”. The computer then connects to the attacker and hands over its user’s login details, which can be cracked or relayed to other systems. Free, well-known tools do this automatically, which is why it shows up in so many intrusions.

How Kandaro catches it

Your decoy regularly asks the network for a name that does not exist. On a healthy network nobody answers. If anything does answer, it is claiming to be a server that isn’t there, which only a poisoning tool does. You get a high-confidence alert that names the address that answered.

The decoy only asks. It never answers anyone else’s questions, so it can’t become a poisoner itself, and it sends no traffic beyond a small question about once a minute.

Two things must be true

1. The decoy is on the same network segment as your workstations. These questions stay inside one network segment (VLAN); they don’t cross routers. A decoy in a separate server VLAN will never hear an attacker sitting among the workstations. If you have several workstation VLANs, one decoy per VLAN covers them.
2. The decoy runs a profile with name-poisoning detection. Today that is the Windows file server profile. Its LLMNR and NBNS services must be left on in the decoy’s settings.

In the Console, Bait & breadcrumbs → Catch network poisoning shows which of your decoys are listening.

What to do when it fires

Treat it as an intrusion: the alert names the address that answered. Find the device behind it, take it off the network, and assume that any login typed on nearby computers since then may have been captured. Reset those passwords.

Longer term, turning off LLMNR and NBT-NS on your Windows computers through group policy removes this weakness. Keep the decoy running anyway: an attacker who tries will still be caught.

Why this alert is never silenced

Marking an address as known good hides routine noise like vulnerability scanners. A poisoning answer is never routine, so it always alerts, even from an address you trust: that would mean the trusted device itself is compromised.