ethoverip
Explanation
The ethoverip NDM is designed to detect when Ethernet traffic is encapsulated within IP packets on the network. This technique, known as ethernet tunneling, can be used for legitimate communication bridging ethernet broadcast domains across routed infrastructure. However, it can also be exploited by attackers to bypass security measures or prevent traffic from being examined.
What to Look For
If Ethernet over IP encapsulation is not expected or authorized in the environment, investigate the sources and destinations of the traffic to determine if there are any signs of malicious activity.
Related MITRE ATT&CK Categories
Updated 20 days ago