Chapter 6:

Layer 2 Attack Categories

1. Understanding MAC Layer Attacks

Step 1. Switch forwards traffic based on valid MAC address table entries.

Step 2. Attacker sends out multiple packets with various source MAC addresses.

Step 3. Over a short time period, the CAM table in the switch fills up until it cannot accept new
entries. As long as the attack is running, the MAC address table on the switch remains full.

Step 4. Switch begins to flood all packets that it receives out of every port so that frames sent from
valid Host to all devices including attacker’s device.

Protecting against MAC Layer Attacks

 To prevent MAC Address flooding, port security can be used. Configure port security to
define the number of MAC addresses allowed on a given port.

 Port security can also specify what MAC address is allowed on a given port.

2. VLAN Attack
2.1. VLAN Hopping Attacks
VLAN hopping attack - where an end system sends packets to, or collects packets from, a VLAN
that should not be accessible to that end system. There are two forms of VLAN hopping attacks.

 Switch spoofing

 Double tagging

2.1.1. Switch Spoofing

Catalyst switches enable trunking in auto mode by default. As a result, the interface becomes a
trunk upon receiving a DTP frame. An attacker can use this default behavior to access VLANs
configured on the switch through one of two methods (first one shown above).

Attacker configures a system to spoof itself as a switch by emulating:

 ISL or 802.1Q signaling

 Dynamic Trunking Protocol (DTP) signaling

Attacking system spoofs itself as a legitimate trunk negotiating device.

 Trunk link is negotiated dynamically.

Attacking device gains access to data on all VLANs carried by the negotiated trunk.

In another type of switch spoofing attack, the network attacker connects an unauthorized Cisco
switch to the switch port. The unauthorized switch can send DTP frames and form a trunk. The
attacker has access to all the VLANs through the trunk. The attacker can attack a victim in any
VLAN.

Solution:

Turn off DTP mode using: switchport mode access interface configuration command and
configure the switch as follows.

Switch(config)#interface range fa 0/11 -

15
Switch(config-if-range)#switchport mode
• access
Without the switchport mode access command, this interface will still try to negotiate
Switch(config-if-range)#switchport
trunking. access
vlan 10
• Now configure the range of interfaces for permanent nontrunking, access mode
 • Notice that negotiation of trunking has been turned off and that this port will only be a
non-trunking access port.

2.1.2. VLAN Hopping – Double Tagging

This form of VLAN hopping attack is possible even if the trunking feature is turned off on the switch
port. The attack involves sending frames with a double 802.1Q tag.

This attack requires the client to be on a switch other than the attacking switch. Another
requirement is that these two switches must be connected in the same VLAN as the attacking
switch port or native VLAN of the trunk between the switch and the attacked VLAN.

• Double tagging allows a frame to be forwarded to a destination VLAN other than the
source’s VLAN.

 Attacker’s workstation generates frames with two 802.1Q headers

 Switch forwards the frames onto a VLAN that would be inaccessible to the
attacker through legitimate means.

Step 1.Attacker (native VLAN 10) sends a frame with two 802.1Q headers to Switch 1.

Step 2.Switch 1 strips the outer tag (VLAN 10)and forwards the frame to all ports within same
native VLAN.Frame is forwarded with the inner 802.1Q tag

Step 3.Switch 2 interprets frame according to information in the inner tag marked with VLAN ID
20.

Step 4.Switch 2 forwards the frame out all ports associated with VLAN 20, including trunk ports.

Mitigating VLAN Hopping: Access Ports

Access Ports

 Configure all unused ports as access ports so that trunking cannot be negotiated
across those links. Place all unused ports in the shutdown state
 Associate all unused ports with a VLAN designed only for unused ports, carrying
no user data traffic (eg. VLAN 999)
Trunk Ports

 Set trunking as “on,” rather than negotiated.

 Set the native VLAN to be different from any data VLANs (VLAN 1 is the default)
 The specific VLAN range to be carried on the trunk

2.2. Attacks between devices on a common VLAN

 Devices may need protection from one another, even though they are on a common
VLAN.

 True for Service provider segments supporting devices from multiple customers.

• Solution

 Private VLANs (PVLANs)

Private VLANs

Slide

3. Spoofing Attacks
3.1. DHCP Spoof Attacks
 One of the ways that an attacker can gain access to network traffic is to spoof responses
that would be sent by a valid DHCP server.

 The DHCP spoofing device replies to client DHCP requests. The legitimate server can reply
also, but if the spoofing device is on the same segment as the client, its reply to the client
might arrive first.
  The intruder’s DHCP reply offers an IP address and supporting information that designates
the intruder as the default gateway or DNS server.

 For a gateway, the clients then forward packets to the attacking device, which in turn sends
them to the desired destination. This is referred to as a man-in-the-middle attack and it
can go entirely undetected as the intruder intercepts the data flow through the network.

Solution

DHCP Snooping

DHCP snooping is a Cisco Catalyst feature that determines which switch ports can respond to DHCP
requests. Ports are identified as trusted and untrusted.

• Trusted ports can source all DHCP messages

 DHCP Server

• Untrusted ports can source requests only

 If a rogue device on an untrusted port attempts to send a DHCP response packet

into the network, the port is shut down.

• From a DHCP snooping perspective, untrusted access ports should not send any DHCP
server responses, such as DHCPOFFER, DHCPACK, or DHCPNAK.

3.2. ARP Spoofing

 In normal ARP operation, a host sends a broadcast to determine the MAC address of a host
with a particular IP address.

 The device at that IP address replies with its MAC address.

 The originating host caches the ARP response, using it to populate the destination Layer 2
header of packets sent to that IP address.

 By spoofing an ARP reply from a legitimate device with a gratuitous ARP, an attacking
device appears to be the destination host sought by the senders.

 The ARP reply from the attacker causes the sender to store the MAC address of the
attacking system in its ARP cache.
  All packets destined for those IP addresses will be forwarded through the attacker system.

Preventing ARP Spoofing through Dynamic ARP Inspection (DAI)

DAI takes these actions:

 Forwards ARP packets received on a trusted interface without any checks.

 Intercepts all ARP packets on untrusted ports.

 Verifies that each intercepted packet has a valid IP-to-MAC address binding before
forwarding packets that can update the local ARP cache.

 Drops and logs ARP packets with invalid IP-to-MAC address bindings.

3.3. MAC Spoofing

 Attacking device spoofs the MAC address of a valid host currently in the CAM table. The
switch then forwards frames destined for the valid host to the attacking device.

Preventing MAC Spoofing

 Use DHCP spoofing an port security.

3.4. Protecting the Operation of STP

Attacking device spoofs the root bridge in the STP topology. If successful, the network attacker

can see a variety of frames.

Mitigating STP manipulation

 Proactively configure the primary and backup root devices. Enable root guard.
Use:

• Root guard, BPDU Guard, BPDU Filtering, Unidirectional Link Detection

4. Switch Device Attacks

4.1. Cisco Discovery Protocol (CDP) Manipulation

Information sent through CDP is transmitted in clear text and unauthenticated, allowing it to be
captured and divulge network topology information.
Solution:

 Disable CDP on all ports where it is not intentionally used.

4.2. Secure Shell Protocol (SSH) and Telnet Attacks

Telnet packets can be read in clear text. SSH is an option but has security issues in version 1.

Solution:

 Use SSH version 2.

 Use Telnet with vty ACLs.