TESTING BUILT-IN SECURITY MECHANISMS OF L2+ NETWORK DEVICES USING NMAP UNDER ACTIVE CONSOLE ACCESS

The article examines the effectiveness of built-in security mechanisms of L2+ network devices under network scanning performed using the nmap utility. The relevance of the study is determined by the widespread use of managed network devices in corporate and educational networks, as well as by the need to minimize the attack surface of management interfaces without deploying additional security tools. Special attention is paid to the analysis of the management plane in the presence of active console access. The purpose of the study is to assess the network accessibility of management services and the state of network ports in the default configuration of network devices from different vendors. The research objects include a MikroTik CRS326-24G-2S+ managed switch and Cisco routers of the 1900 and 800 series. The experimental methodology is based on active network reconnaissance techniques using TCP SYN scanning and on correlating scanning results with actual device configurations obtained via console access. The study shows that in the default configuration the examined devices remain detectable at the IP level but do not expose open remote management services. Management ports are identified as filtered or closed, indicating the operation of built-in traffic filtering and access restriction mechanisms. It is demonstrated that the presence of active console access does not directly affect the results of network scanning. The obtained results confirm the effectiveness of default security configurations in reducing the network attack surface and may be applied in network security assessments as well as in educational and training environments.