© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 1 Common Layer 2 Attacks and Countermeasures

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 2 Agenda  VLAN Attacks and Security VLAN Hopping VTP STP Other  Layer 2 Attacks and Security MAC DHCP ARP Spoofing  Other

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 3 VLAN Attacks and Security

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 4 VLAN Hopping  Dynamic Trunking Protocol Manually configure trunk and access ports, don’t rely on default dynamic port configuration CLI: switchport mode trunk, switchport mode access

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 5 VLAN Hopping  Double Tagging 802.1q frames

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 6 VLAN Hopping Clear unnecessary VLANs on the trunk switchport trunk allowed vlan 10,11,12 switchport trunk allowed vlan remove 10,12 Don’t use trunk native VLAN anywhere else switchport trunk native vlan 999 Set trunks to 802.1q All Tagged mode vlan dot1q tag native

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 7 VTP Security  VTP automatically hands out domain name and VLAN information to VTP server and VTP clients  VTP server not regulated, VTP server with highest revision number is ‘boss’  Use VTP transparent or VTP Server/Client with domain name and passwords

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 8 Port Settings  If a port is connected to a ‘foreign’ device disable layer 2 protocols (CDP, DTP, PAgP, UDLD) switchport host switchport nonegotiate  Enable spanning-tree portfast with BDPU guard and/or root guard, use RPVST+ spanning-tree bpduguard spanning-tree guard root

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 9 Other VLAN Security  Private VLANs  VACLs  Dynamic VLAN assignment  802.1x (Identity based networking)  NAC

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 10 Layer 2 Attacks and Security

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 11

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 12 MAC Attacks  MAC Flooding overflows the switch MAC address table (CAM) forcing the switch to forward frames to all ports on a VLAN (much like a hub)  MACOF tool generates random MAC/IP address combinations in order to overflow the CAM table

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 13 MAC Security  Port Security limits the number of MAC addresses that can be learned on a single port, preventing MAC flooding  Learning MAC static – manually configured, saved in startup config (copy run start) sticky – automatically learned, added to running config, (saved w/copy run start) dynamic – automatically learned, not saved  MAC counters – number of MACs allowed timers – how long to remember MAC(s)  Violation actions protect – drop traffic from unknown MACs when over limit restrict – drop traffic from unknown MACs when over limit and send alarm shutdown – shutdown port with errdisable

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 14 No Port Security Enabled: interface GigabitEthernet1/0/1 switchport access vlan 10 switchport mode access switchport nonegotiate spanning-tree portfast Before MACOF attack: Layer2-Switch#sh mac address-table count Mac Entries for Vlan 10: Dynamic Address Count : 1 Static Address Count : 1 Total Mac Addresses : 2 Total Mac Address Space Available: 6078

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 15

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 16 After MACOF attack: Layer2-Switch#sh mac address-table count Mac Entries for Vlan 10: Dynamic Address Count : 6079 Static Address Count : 1 Total Mac Addresses : 6080 Total Mac Address Space Available: 0

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 17 Port Security Enabled: interface GigabitEthernet1/0/1 switchport access vlan 10 switchport mode access switchport nonegotiate switchport port-security maximum 3 switchport port-security switchport port-security aging time 2 switchport port-security violation restrict switchport port-security aging type inactivity spanning-tree portfast Before MACOF attack: Layer2-Switch#sh port-security Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action (Count) (Count) (Count) Gi1/0/ Restrict Gi1/0/ Restrict Total Addresses in System (excluding one mac per port) : 2 Max Addresses limit in System (excluding one mac per port) : 6272

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 18 During and After MACOF attack: Layer2-Switch#sh mac address-table count Mac Entries for Vlan 10: Dynamic Address Count : 1 Static Address Count : 4 Total Mac Addresses : 5 Total Mac Address Space Available: 6075 Layer2-Switch#sh port-security Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action (Count) (Count) (Count) Gi1/0/ Restrict Gi1/0/ Restrict Total Addresses in System (excluding one mac per port) : 2 Max Addresses limit in System (excluding one mac per port) : 6272

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 19 DHCP Attacks  DHCP Starvation is a DOS attack which prevents valid hosts from getting Dynamic IP configuration  A Rogue DHCP server is used to pass invalid IP configuration information to valid hosts

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 20 DHCP Security  DHCP Exhaustion can be prevented with the same port security measures used to protect against MAC flooding  Rogue DHCP servers can be eliminated with the use of DHCP Snooping where all DHCP request and replies are tracked and rate limited  Valid DHCP server ports must be ‘trusted’

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 21 ARP Attacks  ARP Poisoning is used to alter ARP entries in a switch and on hosts  This allows an attacker to send gratuitous ARP replies redirecting traffic from hosts on the VLAN through his machine

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 22 ARP Security  Dynamic ARP Inspection (DAI) is used to prevent ARP poisoning  DAI uses information in the DHCP snooping table to ensure invalid ARP packets are dropped and ARP packets are rate limited  With both DHCP snooping and DAI static entries can be built for non-DHCP devices

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 23 No DAI Enabled: Before ARP poisoning: PC: C:\>arp -a Interface: x10003 Internet Address Physical Address Type f dynamic b4-98-6f dynamic a6-c0 dynamic Switch: Layer2-Switch#sh arp Protocol Address Age (min) Hardware Addr Type Interface Internet f ARPA Vlan10 Internet b ARPA Vlan10 Internet a6c0 ARPA Vlan10

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 24

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 25 During ARP poisoning: PC: C:\>arp -a Interface: x10003 Internet Address Physical Address Type b4-98-6f dynamic b4-98-6f dynamic b4-98-6f dynamic Switch: Layer2-Switch#sh arp Protocol Address Age (min) Hardware Addr Type Interface Internet f ARPA Vlan10 Internet b4.986f ARPA Vlan10 Internet b4.986f ARPA Vlan10 Telnet Example from Ettercap: TELNET: :23 -> USER: admin PASS: cisco

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 26 DAI Enabled: ip dhcp snooping vlan 10 ip dhcp snooping database flash:dhcpsnooping.db ip dhcp snooping ip arp inspection vlan 10 ip arp inspection validate src-mac dst-mac ip ip arp inspection log-buffer entries 1024 ip arp inspection log-buffer logs 1024 interval 10 interface GigabitEthernet1/0/1 switchport access vlan 10 switchport mode access switchport nonegotiate switchport port-security maximum 3 switchport port-security switchport port-security aging time 2 switchport port-security violation restrict switchport port-security aging type inactivity ip arp inspection limit rate 25 spanning-tree portfast ip verify source ip dhcp snooping limit rate 25

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 27 During ARP poisoning: PC: C:\>arp -a Interface: x10003 Internet Address Physical Address Type f dynamic b4-98-6f dynamic a6-c0 dynamic Switch: Layer2-Switch#sh arp Protocol Address Age (min) Hardware Addr Type Interface Internet f ARPA Vlan10 Internet b ARPA Vlan10 Internet b4.986f ARPA Vlan10 Internet a6c0 ARPA Vlan10 Layer2-Switch#sh log 1d00h: %SW_DAI-4-DHCP_SNOOPING_DENY: 2 Invalid ARPs (Res) on Gi1/0/1, vlan 10. ([ b4.986f/ / a6c0/ /00:14:53 UTC Tue Mar ]) 1d00h: %SW_DAI-4-DHCP_SNOOPING_DENY: 2 Invalid ARPs (Res) on Gi1/0/1, vlan 10. ([ b4.986f/ /0006.5b / /00:14:53 UTC Tue Mar ]) 1d00h: %SW_DAI-4-DHCP_SNOOPING_DENY: 2 Invalid ARPs (Res) on Gi1/0/1, vlan 10. ([ b4.986f/ / a6c0/ /00:14:53 UTC Tue Mar ])

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 28 Spoofing Attacks  MAC Spoofing  IP Spoofing  Spoofing is a method of using the MAC or IP address of another device and then assuming the privilege level of that device

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 29 Spoofing Security  IP Source Guard prevents both MAC and IP address spoofing using info from the DHCP snooping table  Preventing MAC spoofing requires specific option 82 to be assigned by DHCP server (Cisco Registrar, Cisco IOS and Avaya DHCP server can do this)  Preventing IP spoofing has no other requirements and is configured per port

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 30 No IP Source Guard Enabled: interface GigabitEthernet1/0/1 switchport access vlan 10 switchport mode access switchport nonegotiate switchport port-security maximum 3 switchport port-security switchport port-security aging time 2 switchport port-security violation restrict switchport port-security aging type inactivity ip arp inspection limit rate 25 spanning-tree portfast ip dhcp snooping limit rate 25

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 31 Debug of IP spoofing attack: Layer2-Switch#debug ip icmp ICMP packet debugging is on Layer2-Switch# From attacker machine ( ) not spoofing: nemesis icmp -S D On Switch: Layer2-Switch# 1d00h: ICMP: echo reply sent, src , dst From attacker machine ( ) spoofing : nemesis icmp -S D On Switch: Layer2-Switch# 1d00h: ICMP: echo reply sent, src , dst

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 32

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 33 IP Source Guard Enabled: interface GigabitEthernet1/0/1 switchport access vlan 10 switchport mode access switchport nonegotiate switchport port-security maximum 3 switchport port-security switchport port-security aging time 2 switchport port-security violation restrict switchport port-security aging type inactivity ip arp inspection limit rate 25 spanning-tree portfast ip verify source ip dhcp snooping limit rate 25

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 34 Debug of IP spoofing attack: Layer2-Switch#debug ip icmp ICMP packet debugging is on Layer2-Switch# From attacker machine ( ) not spoofing: nemesis icmp -S D On Switch: Layer2-Switch# 1d00h: ICMP: echo reply sent, src , dst From attacker machine ( ) spoofing : nemesis icmp -S D On Switch: [nothing]

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 35 Other Notables  HSRP/GLBP Authentication  Routing Protocol Authentication  Storm Control