Audit your Cisco router's security with Nipper - Network Admin - Techguide
Breaking News: CFOs increasingly involved in IT investment decisions

ZDNet / Techguide / Network Admin

Audit your Cisco router's security with Nipper

By David Davis , TechRepublic on December 17, 2007 

 

Summary

Find out more about Nipper, an open source network devices security auditing tool, and why companies can benefit from it.

Events

Echelon 2012
June 11 and 12, 2012

University Cultural Centre, National University of Singapore

Startup Asia Jakarta 2012
June 7 and 8, 2012

12th Floor, Annex Building, Wisma Nusantara Complex, Jl. M.H. Thamrin No. 59 Jakarta 10350, Indonesia

MMA Forum Singapore
April 23-25, 2012

Grand Hyatt Singapore

Submit

While recently talking with a fellow network admin, I learned about Nipper. While there are many tools available to perform security audits of network devices, Nipper is unique. Let me show you why.

What is Nipper?
Short for Network Infrastructure Parser, Nipper is an open source network devices security auditing tool. One benefit of being open source is that it's free.

Previously known as CiscoParse, Nipper isn't especially polished, but it is very functional. It was easy to install and easy to use, and it did exactly what it said it would do.

Even more impressive is that it works with many different types of network devices (and not just Cisco). Here's a list of compatible network devices that Nipper can audit:

  • Cisco switches (IOS)
  • Cisco routers (IOS)
  • Cisco firewalls (PIX, ASA, FWSM) 
  • Cisco Catalyst switches (NMP, CatOS, IOS)
  • Cisco Content Service Switches (CSS)
  • Juniper NetScreen Firewalls (ScreenOS)

How do you use Nipper?
Nipper supports a lot of devices and boasts a ton of options, so I can't possibly demonstrate all that it can do. But I can give you a basic demonstration. For our example, we'll use Nipper to audit a Cisco router that has only the default configuration.

To begin, I took a Cisco 2600 Series router, cleared the configuration, and rebooted it. Then, the process of auditing the router begins.

First, download Nipper from SourceForge.net -- it's available for both Windows and Linux. Extract it to a folder on your local PC; let's call it C:\nipper.

Next, obtain a text version of the router's configuration file. Telnet or SSH to the router, use the show running-configuration command, copy and paste the output into Notepad, and save it to your local PC in the aforementioned C:\nipper directory.

Alternatively, you can use a TFTP server and copy the configuration to your local PC. For example, I tried this using Tftpd32.exe, and it was both quick and easy. Use the copy running-configuration tftp command.

Once you have the running configuration that you want to audit on your PC, go to the Windows command prompt, and CD into the Nipper directory. Run the following, as shown in Figure A:

nipper --ios-router --input=testrouterconfig.txt 
--output=audit.html
Figure A

Figure A

The system will immediately return you to the command prompt without providing any information. But don't worry -- it worked.

Next, open a Web browser and enter this URL: c:\nipper\audit.html. This will take you to the security report. Figure B offers a screenshot of the audit.

Figure B

Figure B

What does Nipper tell you?
Scrolling through this report, you'll see that Nipper provides security audit information such as:

  • A software version that has vulnerabilities and the reference numbers for those vulnerabilities
  • Recommendations to disable services that might cause others to be able to access the router
  • Commands that you need to enable to secure the router

For our example, Nipper told us that we need to do the following:

  • Upgrade the router's IOS needs to prevent vulnerability to a Telnet remote DoS attack and a TCP listener DoS attack.
  • Configure the service tcp-keepalives-in command to help prevent a DoS attack.
  • Configure timeouts on consoles to prevent anyone from gaining access to the router from a Telnet or console session.
  • Configure the HTTP service as secure with HTTPS, and enable authentication.
  • Enable logging.

In addition to several other recommendations, Nipper provided a summary of the device's configuration -- what services are turned on or off, status of the lines, status of the interfaces, DNS, time zone, and more. Check out the actual report from our example.

Considering that it's so small, simple, and free, Nipper is an amazingly powerful network device security auditing tool. For help with Nipper, run the C:\nipper\nipper -help command at the command prompt after you've downloaded, extracted, run the program.

David Davis has worked in the IT industry for 12 years and holds several certifications, including CCIE, MCSE+I, CISSP, CCNA, CCDA, and CCNP. He currently manages a group of systems/network administrators for a privately owned retail company and performs networking/systems consulting on a part-time basis.

Talkback

Add your opinion

In order to post a comment, you need to be registered. (Sign In or register below)

Post your comment

Resource Centre Useful content from our premier sponsors

Network Admin TechGuides

5 tips to help prevent networking configuration oversights

3 PowerShell queries to obtain critical system information

Network security: 7 tips for desktop malware first responders

Fix slow workstations with this tune-up checklist

5 most overlooked networking configuration items

Disabling indirect file transfer through remote desktop

Delegating DNS record write permissions

Identify network settings applied via Group Policy

Set an icon to identify your network

SNMP security: Maligned or ignored, but useful for risk management

More

ZDNet Asia Live

Fanboys on AV for Mac: "ludicrous" "a waste of time" "The Mac will protect me" "the most secure ever" "impenetrable" http://t.co/a1o2Sz7E

RT @ameliatmy: the hottest angel investment & venture capital event in #MALAYSIA! will u be there? http://t.co/ChSjkmzu #ABAF

Singapore Game Box in the ZDnet news!
http://t.co/UuTs0SqX http://t.co/YdPKmm39

#radio Radio Bolivia by EnjoyIT 1.0 http://t.co/fdlBPOeI

RT @zdnetasia: SingTel acquires HungryGoWhere for US$9.4 million. http://t.co/Qho1REVZ

Gartner: Mobile CRM gives better ROI than social - http://t.co/s5OfTAXK #CRM

RT @zdnetasia: S'pore sets up portal to grow games sector. http://t.co/In8gtj7L

#Malaysia: 20% yoy rise in overall #wages for both direct and non-direct labor. http://t.co/5T2e0LUU

RT @mikebuetow: #Malaysia: 20% yoy rise in overall #wages for both direct and non-direct labor. http://t.co/5T2e0LUU

@88tc88 RT @KevinZDNetAsia: User experience more important to app monetization than actual content http://t.co/ogbD5wyI… #li #dm12

Dubbed the first social #Olympics, this year's summer games have some of the strictest social rules for all involved http://t.co/4HlcqhW3

Value of big data analytics largely untapped - Zd Net http://t.co/ZuhPrCN4: Pushing cloud limits for d... http://t.co/VyOU0vHz #TheBIBlog

Value of big data analytics largely untapped http://t.co/026PCpSc @zdnetasia

RT @data_nerd: Value of big data analytics largely untapped http://t.co/026PCpSc @zdnetasia

Active WebTraffic - Downloads - ZDNet Asia: Active WebTraffic is a web promotion tool that includes ... http://t.co/fMJepPh8 #webtraffic

So much as we know , MTK6575 extremely integrated frequency1GHz ARM Cortex-A9 processor, the superiority of 3G / HSPA Modem, and help the...

14 hours ago by y15822137359 on 5 SaaS adoption speed bumps to avoid

I reckon your view: "CRM is strategy, not software", if a company replicating the approach uses in ERP implementation into CRM, what they...

1 day ago by wykoong on Gartner: Mobile CRM gives better ROI than social

This video will teach you about the Excel fill handle but also provide you with a workook to download... http://www.youtube.com/watch?v=...

2 days ago by TradeBrother on A quick fill handle trick for Microsoft Excel

waiting...

4 days ago by eapete on What should count in a company's market value?

Boy, you've opened a can of worms now.

Wait for the rants & raves.

4 days ago by eapete on What should count in a company's market value?

I was puzzling before this whether to replicate the success formula we executed for a financial institute, and come out with a standard s...

4 days ago by wykoong on Drop the egos, copy ideas, then innovate

Keep up with ZDNet Asia

Facebook Join our fan page

RSS Feeds Subscribe now

NewslettersNewsletters Subscribe today

Twitter Follow us

Whitepapers

Understanding Awareness in Mixed Presence Collaboration

How to gain total message system visibility

IBM System x® x86 servers: Delivering customer satisfaction by excelling in hardware and support

Analytics and the Smarter Planet

Social Media Analytics: Making Customer Insights Actionable

Downloads

Make Me Old : Photo editing and effects to look older 1.1

MarsEdit 3.5.3

NETWORK PLAYER CONTROLLER - US 2.03

Sleep Sound Premium Funny 1.0

Confidence: The Game 2.10

Network Admin News

Motorola's ITC complaint against Microsoft to be heard

Virtual biz cards won't dethrone paper ones

Cisco CEO's key risk: Running a company on social networking

Human touch needed to manage social strategy

Facebook top social networking site in India