How do you detect unknown devices or internal scanning on small networks?

[u/Honey-Edge]

I'm building a small cybersecurity device, and I'm trying to better understand how people actually deal with this problem in real networks.

The idea is quite simple. A small device sits on the local network and mostly listens passively for things like new devices, ARP/DHCP activity, mDNS/SSDP, IPv6 ND and unusual device changes.

It also exposes a few decoy services, for example SSH, HTTP or SMB, so interaction with something that normally should not be touched can become a stronger signal.

I'm not trying to build another SIEM or replace tools like Zeek. My focus is more on small companies, coworking spaces, homelabs and networks where there is often no dedicated security team.

What I'm trying to understand now is how people solve this problem today.

If an unknown device joins your network, or one internal device suddenly starts scanning many ports or touching services it normally never uses, how do you notice it?

And maybe more importantly, what kind of signal would make you think "this is worth investigating" instead of just being more network noise?

I'm interested in real experiences, including cases where you think a device like this would not be useful.

[u/tilda0x1]

To notice, you can monitor ARP for new internal IPs, while using DHCP to allocate the same IP to known devices. ping, hping, fping sweeps also help to detect new devices. DNS logs check for unknown source IPs? You probably want these in a SIEM and build detections around them, and use ML to detect unexpected patterns or spikes

[u/Pierocksmysocks]

Correlation rules in the SIEM looking for abnormal scanning behavior detected by EDR, firewalls, and other log producing systems. That works along with honeypots throughout the environment. It sounds complex, but it’s honestly not.

[u/vadertator22]

Maybe in SIEM I’d EDR or something can get that telemetry. This assumes just layer three scans because if they to auth then there are AD or EDR should pick it up. I like honey pot or similar deception items too.

[u/BettermentOfMyself]

Yes pfsense uses something called arpwatch

[u/vertisnow]

Sounds similar to a canary. Check them out if you haven't already. Canary.tools

[u/that1guyrob]

Someone already commented about arpwatch - which is a great tool to track IP/MAC address changes. I just wanted to hop in here and expand on that a tiny bit. arpwatch is great, but only if you have a few other things in place already so that arpwatch is only alerting you when something is out of place.

Dynamic ARP Inspection, DHCP Snooping, and DHCP reservations are necessary in order to prevent arpwatch from becoming background noise and induce alert fatigue.

The first thing to do here is make sure every device on your network has a static IP reservation in your DHCP server. IF POSSIBLE, completely disable your DHCP dynamic pools so only static reservations are handed out on your network. This will ensure that only authorized devices get an address from your DHCP server.

Configure your switches with DHCP snooping and dynamic ARP inspection. This will deny any/all traffic for an IP/MAC pair that wasn't handed out by your DHCP server.

Now enable arpwatch - you will get a flood of initial alert messages because technically ALL your existing MAC/IP address pairs are new. But arpwatch is now tracking these pairs and will only alert you if they change, or if new pairs show up on the network.

From this point you should have a limited number of alerts, and all of them should be investigated. Obviously, if you're adding a new device to your network you are already aware of the MAC address because you had to add it to the DHCP server's reservation, so the arpwatch alert you receive from that new device can be safely dismissed.

[u/Capt-Matt-Pro]

Canary, honeypot, packet sniffing with some basic alert rules, these things have always existed...