Network Security CPSC 6128 Lecture 8 Layer 2

Network Security CPSC 6128 – Lecture 8 Layer 2 Security CPSC 6128 - Network Security 1

Layer 2 Switch Security CPSC 6128 - Network Security 2

Why Worry About Layer 2 Security? q. OSI was built to allow different layers vto work without the knowledge of each other Host A Application Host B Application Stream Application Presentation Session Transport Protocols/Ports Transport Network IP Addresses Network Data Link Physical MAC Addresses Physical Links CPSC 6128 - Network Security Data Link Physical 3

Lower Levels Affect Higher Levels q This means if one layer is hacked vcommunications are compromised without the other layers being aware q Security is only as strong as the weakest link q Layer 2 can be VERY weak Application Stream Presentation Session Transport Network Data Link Physical Compromised Application POP 3, IMAP, IM, SSL, SSH Application Presentation Session Protocols/Ports Transport IP Addresses Network Initial Compromise Physical Links CPSC 6128 - Network Security Data Link Physical 4

MAC Attacks CPSC 6128 - Network Security 5

MAC Address CAM Table 48 -Bit Hexadecimal Number Creates Unique Layer Two Address 1234. 5678. 9 ABC First 24 -Bits = Manufacture Code Assigned by IEEE Second 24 -Bits = Specific Interface, Assigned by Manufacture 0000. 0 c. XX. XXXX All Fs = Broadcast FFFF q. CAM table stands for Content Addressable Memory q. The CAM tables stores information v MAC addresses available on physical ports with their associated VLAN parameters q. All CAM tables have a fixed size CPSC 6128 - Network Security 6

Normal CAM Behavior 1/3 3 Port 2 r. B C fo Port 1 MAC B A R P MAC A ARP for B Port 1 MAC A Port 3 P R A r. B fo B Is Unknown— Flood the Frame MAC C CPSC 6128 - Network Security 7

Normal CAM Behavior 2/3 Port 1 2 3 M A C B Port 2 MAC B IA m MAC A B C I Am MAC B Port 1 MAC A Port 3 A is on Port 1 LEARN B is on Port 2 MAC C CPSC 6128 - Network Security 8

Normal CAM Behavior 3/3 Port 1 2 3 A> B Port 2 Tr af fic MAC A B C MAC B Traffic A -> B Port 1 MAC A Port 3 B Is on Port 2 Does Not See Traffic to B CPSC 6128 - Network Security MAC C 9

CAM Overflow – Tools q. Macof tool v. About 100 lines of PERL v. Included in DSNIFF q. Attack successful by exploiting the size limit on CAM tables q. Yersinia – Swiss-army knife for layer 2 attacks CPSC 6128 - Network Security 10

CAM Overflow Port 2 A Y Is on Port 3 B Assume CAM Table Now Full MAC B fic Port 13 23 3 Tr af MAC YA ZB C Traffic A B Port 1 MAC A Z C AYA f. Mi. Cc a. Af r. Mm I TA m IA Port 3 Z Is on Port 3 B MAC C I See Traffic to B CPSC 6128 - Network Security 11

MAC Flooding Switches with macof –i eth 1 36: a 1: 48: 63: 81: 70 15: 26: 8 d: 4 d: 28: f 8 0. 0. 26413 > 0. 0. 49492: S 1094191437: 1094191437(0) win 512 16: e 8: 8: 0: 4 d: 9 c da: 4 d: bc: 7 c: ef: be 0. 0. 61376 > 0. 0. 47523: S 446486755: 446486755(0) win 512 18: 2 a: de: 56: 38: 71 33: af: 9 b: 5: a 6: 97 0. 0. 20086 > 0. 0. 6728: S 105051945: 105051945(0) win 512 e 7: 5 c: 97: 42: ec: 1 83: 73: 1 a: 32: 20: 93 0. 0. 45282 > 0. 0. 24898: S 1838062028: 1838062028(0) win 512 62: 69: d 3: 1 c: 79: ef 80: 13: 35: 4: cb: d 0 0. 0. 11587 > 0. 0. 7723: S 1792413296: 1792413296(0) win 512 c 5: a: b 7: 3 e: 3 c: 7 a 3 a: ee: c 0: 23: 4 a: fe 0. 0. 19784 > 0. 0. 57433: S 1018924173: 1018924173(0) win 512 88: 43: ee: 51: c 7: 68 b 4: 8 d: ec: 3 e: 14: bb 0. 0. 283 > 0. 0. 11466: S 727776406: 727776406(0) win 512 b 8: 7 a: 2 d: 2 c: ae c 2: fa: 2 d: 7 d: e 7: bf 0. 0. 32650 > 0. 0. 11324: S 605528173: 605528173(0) win 512 e 0: d 8: 1 e: 74: 1: e 57: 98: b 6: 5 a: fa: de 0. 0. 36346 > 0. 0. 55700: S 2128143986: 2128143986(0) win 512 q. Macof sends random source MAC and IP addresses q. Much more aggressive if you run the command vmacof –I eth 1 2>/dev/null v. Macof (part of DSNIFF): http: //monkey. org/~dugsong/dsniff/ CPSC 6128 - Network Security 12

CAM Table FULL 10. 1. 1. 22 10. 1. 1. 26 10. 1. 1. 25 -> -> (broadcast) 10. 1. 1. 25 10. 1. 1. 26 ARP C Who ICMP Echo is 10. 1. 1. 1, 10. 1. 1. 1 ? is 10. 1. 1. 19, 10. 1. 1. 19 ? request (ID: 256 Sequence number: 7424) OOPS reply (ID: 256 Sequence number: 7424) OOPS q Once the CAM table on the switch is full vtraffic without a CAM entry is flooded out every port on that VLAN q This will turn a VLAN on a switch into a “hub” q This attack will also fill the CAM tables of adjacent switches CPSC 6128 - Network Security 13

Countermeasures for MAC Attacks Port Security Limits the Amount of MACs on an Interface Solution § Port security limits MAC flooding attack and locks down port and sends an SNMP trap 00: 0 e: 00: aa: aa 00: 0 e: 00: bb: bb Only One MAC Addresses Allowed on the Port: Shutdown 132, 000 Bogus MACs CPSC 6128 - Network Security 14

Countermeasure for MAC Attacks with IP Phones q Phones can use two or three depending on the switch hardware and software q Default config is disable port, might want to restrict for Vo. IP q This feature is to protect that switch, you can make the number anything you like as long as you don’t overrun the CAM table Could Use Two or Three MAC Addresses Allowed on the Port: Shutdown CPSC 6128 - Network Security 15

Port Security: Example Config Cisco Catalyst OS set port security 5/1 enable set port security 5/1 port max 3 set port security 5/1 violation restrict set port security 5/1 age 2 set port security 5/1 timer-type inactivity Cisco IOS switchport-security maximum 3 switchport-security violation restrict switchport-security aging time 2 switchport-security aging type inactivity q Number is not to control access, it is to protect the switch from attack q Depending on security policy, disabling the port might be preferred, even with Vo. IP q Aging time of two and aging type inactivity to allow for phone CDP of 1 minute CPSC 6128 - Network Security 16

Port Security q. In the past you would have to Øtype in the only MAC you were going to allow on that port q. You can now put a limit on Øhow many MAC addresses a port will learn q. You can also put timers in to state Øhow long the MAC address will be bound to that switch port q. You might still want to do static MAC entries on ports Øthat there should be no movement of devices, such as in server farms CPSC 6128 - Network Security 17

Building the Layers q. Port Security prevents CAM attacks Port Security CPSC 6128 - Network Security 18

VLAN Hopping Attacks CPSC 6128 - Network Security 19

Basic Trunk Port Defined VLAN 10 Trunk with: Native VLAN 10 VLAN 20 VLAN 10 q Trunk ports have access to all VLANs by default q Used to route traffic for multiple VLANs across the same physical link (generally between switches or phones) q Encapsulation can be 802. 1 q or ISL CPSC 6128 - Network Security 20

Dynamic Trunk Protocol (DTP) q What is DTP? v Automates 802. 1 x/ISL trunk configuration v Operates between switches Dynamic Trunk Protocol v Does not operate on routers v Support varies, check your device q DTP synchronizes the trunking mode on end links CPSC 6128 - Network Security 21

Basic VLAN Hopping Attack VLAN 10 Trunk with: Native VLAN 10 VLAN 20 VLAN 10 q An end station can spoof as a switch with ISL or 802. 1 q q The station is then a member of all VLANs q Requires a trunking configuration of the native VLAN to be VLAN 1 CPSC 6128 - Network Security 22

Double 802. 1 q Encapsulation VLAN Hopping Attack src mac dst mac 8100 5 8100 96 1 st tag 80 2. 1 q 0800 data 2 nd tag , 80 2. 1 q 802. 1 q Frame Fr am e Strip Off First, and Send Back Out q Send 802. 1 q double encapsulated frames q Switch performs only one level of decapsulation q Unidirectional traffic only q Works even if trunk ports are set to off CPSC 6128 - Network Security 23

Security Best Practices for VLANs and Trunking q. Always use a dedicated VLAN ID for all trunk ports q. Be paranoid: do not use VLAN 1 for anything v. By default, all switch ports are part of VLAN 1 v. VLAN 1 contains control plane traffic and can contain user traffic q. Disable auto-trunking on user facing ports (DTP off) q. Explicitly configure trunking on infrastructure ports q. Use all tagged mode for the native VLAN on trunks CPSC 6128 - Network Security 24

DHCP Attacks CPSC 6128 - Network Security 25

DHCP Function: High Level DHCP Server Client Send My Configuration Information IP Address: 10. 10. 101 Subnet Mask: 255. 0 Default Routers: 10. 10. 1 DNS Servers: 192. 168. 10. 4, 192. 168. 10. 5 Lease Time: 10 days Here Is Your Configuration q Server dynamically assigns IP address on demand q Administrator creates pools of addresses available for assignment q Address is assigned with lease time q DHCP delivers other configuration information in options CPSC 6128 - Network Security 26

DHCP Function: Lower Level DHCP Server Client DHCP Discover (Broadcast) DHCP Offer (Unicast) DHCP Request (Broadcast) DHCP Ack (Unicast) q DHCP defined by RFC 2131 CPSC 6128 - Network Security

DHCP Function: Lower Level DHCP Request/Reply Types Message Use DHCPDISCOVER Client Broadcast to Locate Available Servers DHCPOFFER Server to Client in Response to DHCPDISCOVER with Offer of Configuration Parameters DHCPREQUEST Client Message to Servers Either (a) Requesting Offered Parameters from One Server and Implicitly Declining Offers from All Others, (b) Confirming Correctness of Previously Allocated Address After, e. g. , System Reboot, or (c) Extending the Lease on a Particular Network Address DHCPACK Server to Client with Configuration Parameters, Including Committed Network Address DHCPNAK Server to Client Indicating Client’s Notion of Network Address Is Incorrect (e. g. , Client Has Moved to New Subnet) or Client’s Lease as Expired DHCPDECLINE Client to Server Indicating Network Address Is Already in Use DHCPRELEASE Client to Server Relinquishing Network Address and Canceling Remaining Lease DHCPINFORM Client to Server, Asking Only for Local Configuration Parameters; Client Already Has Externally Configured Network Address. CPSC 6128 - Network Security

DHCP Function: Lower Level IPv 4 DHCP Packet Format OP Code Hardware Type Hardware Length HOPS Transaction ID (XID) Flags Seconds Client IP Address (CIADDR) Your IP Address (YIADDR) Server IP Address (SIADDR) Gateway IP Address (GIADDR) Client Hardware Address (CHADDR)— 16 Bytes Server Name (SNAME)— 64 Bytes Filename— 128 Bytes DHCP Options CPSC 6128 - Network Security

DHCP Attack Types - DHCP Starvation Attack Client DHCP Server Gobbler DHCP Discovery (Broadcast) x (Size of Scope) DHCP Offer (Unicast) x (Size of DHCPScope) DHCP Request (Broadcast) x (Size of Scope) DHCP Ack (Unicast) x (Size of Scope) q Gobbler/DHCPx looks at the entire DHCP scope and tries to lease all of the DHCP addresses available in the DHCP scope q This is a Denial of Service (Do. S) attack using DHCP leases CPSC 6128 - Network Security

Countermeasures for DHCP Attacks DHCP Starvation Attack = Port Security Client DHCP Server Gobbler q Gobbler uses a new MAC address to request a new DHCP lease q Restrict the number of MAC addresses on a port q Will not be able to lease more IP address then MAC addresses allowed on the port q In the example the attacker would get one IP address from the DHCP server Cisco Catalyst OS set port security 5/1 enable set port security 5/1 port max 1 set port security 5/1 violation restrict set port security 5/1 age 2 set port security 5/1 timer-type inactivity Cisco IOS switchport-security maximum 1 switchport-security violation restrict switchport-security aging time 2 switchport-security aging type inactivity CPSC 6128 - Network Security

DHCP Attack Types - Rogue DHCP Server Attack Client Rogue Server or Unapproved DHCP Discovery (Broadcast) DHCP Offer (Unicast) from Rogue Server DHCP Request (Broadcast) DHCP Ack (Unicast) from Rogue Server CPSC 6128 - Network Security DHCP Server

DHCP Attack Types -Rogue DHCP Server Attack q. What can the attacker do if he is the DHCP server? IP Address: 10. 10. 101 Subnet Mask: 255. 0 Default Routers: 10. 10. 1 DNS Servers: 192. 168. 10. 4, 192. 168. 10. 5 Lease Time: 10 days Here Is Your Configuration • What do you see as a potential problem with incorrect information? • Wrong default gateway—Attacker is the gateway • Wrong DNS server—Attacker is DNS server • Wrong IP address—Attacker does DOS with incorrect IP CPSC 6128 - Network Security

Countermeasures for DHCP Attacks Rogue DHCP Server = DHCP Snooping-Enabled Client Untrusted Trusted Untrusted OK DHCP Responses: offer, ack, nak Rogue Server BAD DHCP Responses: offer, ack, nak DHCP Server Cisco IOS Global Commands ip dhcp snooping vlan 4, 104 no ip dhcp snooping information option ip dhcp snooping DHCP Snooping Untrusted Client Interface Commands no ip dhcp snooping trust (Default) ip dhcp snooping limit rate 10 (pps) DHCP Snooping Trusted Server or Uplink Interface Commands ip dhcp snooping trust q By default all ports in the VLAN are untrusted CPSC 6128 - Network Security

Countermeasures for DHCP Attacks Rogue DHCP Server = DHCP Snooping-Enabled Client Untrusted Trusted Untrusted OK DHCP Responses: offer, ack, nak Rogue Server BAD DHCP Responses: offer, ack, nak DHCP Snooping Binding Table sh ip dhcp snooping binding Mac. Address Ip. Address Lease(sec) Type VLAN Interface --------- -------------00: 03: 47: B 5: 9 F: AD 10. 120. 4. 10 193185 dhcp-snooping 4 Fast. Ethernet 3/18 q Table is built by “snooping” the DHCP reply to the client q Entries stay in table until DHCP lease time expires CPSC 6128 - Network Security DHCP Server

Advanced Configuration DHCP Snooping § § § Gobbler uses a unique MAC for each DHCP request and port security prevents Gobbler What if the attack used the same interface MAC address, but changed the client hardware address in the request? Port security would not work for that attack The switches check the CHADDR field of the request to make sure it matches the hardware MAC in the DHCP snooping binding table If there is not a match, the request is dropped at the interface OP Code Hardware Type Hardware Length HOPS Transaction ID (XID) Flags Seconds Client IP Address (CIADDR) Your IP Address (YIADDR) Server IP Address (SIADDR) Gateway IP Address (GIADDR) Client Hardware Address (CHADDR)— 16 Bytes Server Name (SNAME)— 64 Bytes Filename— 128 Bytes DHCP Options Note: Some switches have this on by default, and other’s don’t; please check the documentation for settings CPSC 6128 - Network Security

DHCP Rogue Server q If there are switches in the network that will not support DHCP snooping, you can configure VLAN ACLs to block UDP port 68 set security acl ip ROGUE-DHCP permit udp host 192. 0. 2. 1 any eq 68 set security acl ip ROGUE-DHCP deny udp any eq 68 set security acl ip ROGUE-DHCP permit ip any set security acl ip ROGUE-DHCP permit udp host 10. 1. 1. 99 any eq 68 § Will not prevent the CHADDR DHCP starvation attack Router 192. 0. 2. 1 CPSC 6128 - Network Security DHCP Server 10. 1. 1. 99

Summary of DHCP Attacks q. DHCP starvation attacks Øcan be mitigated by port security q. Rogue DHCP servers attacks Øcan be mitigated by DHCP snooping features q. When configured with DHCP snooping, Øall ports in the VLAN will be “untrusted” for DHCP replies q. Check default settings to see Øif the CHADDR field is being checked during the DHCP request q. Unsupported switches Ø can run ACLs for partial attack mitigation (can not check the CHADDR field) CPSC 6128 - Network Security

Building the Layers q. Port security prevents v. CAM attacks and v. DHCP starvation attacks q. DHCP snooping prevents vrogue DHCP server attacks DHCP Snooping Port Security CPSC 6128 - Network Security

ARP Attacks CPSC 6128 - Network Security 40

ARP Function Review q Before a station can talk to another one vit must do an ARP request to map the IP address to the MAC address v. This ARP request is broadcast using protocol 0806 v. All computers on the subnet will receive and process the ARP request vthe station that matches the IP address in the request will send an ARP reply I Am 10. 1. 1. 4 MAC A Who Is 10. 1. 1. 4? CPSC 6128 - Network Security

ARP Function Review (Cont. ) q According to the ARP RFC va client is allowed to send an unsolicited ARP reply vthis is called a gratuitous ARP vother hosts on the same subnet can store this information in their ARP tables q Anyone can claim to be the owner of any IP/MAC address they like v. ARP attacks use this to redirect traffic You Are 10. 1. 1. 1 MAC A I Am 10. 1. 1. 1 MAC A You Are 10. 1. 1. 1 MAC A CPSC 6128 - Network Security You Are 10. 1. 1. 1 MAC A

ARP Attack Tools q. Many tools on the net for ARP man-in-the-middle attacks v. Dsniff, Cain & Abel, ettercap, Yersinia, etc. qettercap vhttp: //ettercap. sourceforge. net/index. php v. Some are second or third generation of ARP attack tools v. Most have a very nice GUI, and is almost point and click v. Packet insertion, many to many ARP attack q. All of them capture the traffic/passwords of applications v. FTP, Telnet, SMTP, HTTP, POP, NNTP, IMAP, SNMP, LDAP, RIP, OSPF, PPTP, MS-CHAP, SOCKS, X 11, IRC, ICQ, AIM, SMB, Microsoft SQL, etc. CPSC 6128 - Network Security

ARP Attack Tools q Ettercap in action q As you can see runs in Window, Linux, Mac q Decodes passwords on the fly q This example, telnet username/ password is captured CPSC 6128 - Network Security

ARP Attack Tools: SSH/SSL (? ) q Using these tools v. SSL/SSH sessions can be intercepted and bogus certificate credentials can be presented q Once you have excepted the certificate vall SSL/SSH traffic for all SSL/SSH sites can flow through the attacker CPSC 6128 - Network Security

ARP Attack in Action q Attacker “poisons” the ARP tables 10. 1. 1. 1 MAC A ARP 10. 1. 1. 1 Saying 10. 1. 1. 2 Is MAC C 10. 1. 1. 2 Is Now MAC C ARP 10. 1. 1. 2 Saying 10. 1. 1. 1 Is MAC C 10. 1. 1. 3 MAC C 10. 1. 1. 2 MAC B 10. 1. 1. 1 Is Now MAC C CPSC 6128 - Network Security

ARP Attack in Action q All traffic flows through the attacker 10. 1. 1. 1 MAC A Transmit/Receive Traffic to 10. 1. 1. 2 MAC C 10. 1. 1. 2 Is Now MAC C Transmit/Receive Traffic to 10. 1. 1. 1 MAC C 10. 1. 1. 3 MAC C 10. 1. 1. 2 MAC B 10. 1. 1. 1 Is Now MAC C CPSC 6128 - Network Security

ARP Attack Clean Up q Attacker corrects ARP tables entries q Traffic flows return to normal 10. 1. 1. 2 Is Now MAC B 10. 1. 1. 1 MAC A ARP 10. 1. 1. 1 Saying 10. 1. 1. 2 Is MAC B ARP 10. 1. 1. 2 Saying 10. 1. 1. 1 Is MAC A 10. 1. 1. 3 MAC C 10. 1. 1. 2 MAC B 10. 1. 1. 1 Is Now MAC A CPSC 6128 - Network Security

Countermeasures to ARP Attacks: Dynamic ARP Inspection q Uses the DHCP 10. 1. 1. 1 MAC A ARP 10. 1. 1. 1 Saying 10. 1. 1. 2 Is MAC C Is. None This Is My NO Matching Binding Table? ARPs in the Bit Bucket DHCP Snooping. Enabled Dynamic ARP Inspection. Enabled 10. 1. 1. 3 MAC C snooping binding table information q Dynamic ARP inspection v. All ARP packets must match the IP/MAC binding table entries v. If the entries do not match, throw them in the bit bucket 10. 1. 1. 2 MAC B ARP 10. 1. 1. 2 Saying 10. 1. 1. 1 Is MAC C CPSC 6128 - Network Security

Countermeasures to ARP Attacks: Dynamic ARP Inspection q. DHCP snooping has to be configured so the binding table it built q. DAI is configured by VLAN q. You can trust an interface like DHCP snooping CPSC 6128 - Network Security

Countermeasures to ARP Attacks: Dynamic ARP Inspection q Uses the information from the DHCP snooping binding table sh ip dhcp snooping binding Mac. Address Ip. Address Lease(sec) Type VLAN Interface ----------------------00: 03: 47: B 5: 9 F: AD 10. 120. 4. 10 193185 dhcp-snooping 4 Fast. Ethernet 3/18 q Check the mac address and IP address fields to see vif the ARP from the interface is in the binding vif not, traffic is blocked CPSC 6128 - Network Security

Countermeasures to ARP Attacks: Dynamic ARP Inspection Commands Cisco IOS Global Commands ip dhcp snooping vlan 4, 104 no ip dhcp snooping information option ip dhcp snooping ip arp inspection vlan 4, 104 ip arp inspection log-buffer entries 1024 ip arp inspection log-buffer logs 1024 interval 10 Interface Commands ip dhcp snooping trust ip arp inspection trust Cisco IOS Interface Commands no ip arp inspection trust (default) ip arp inspection limit rate 15 (pps) CPSC 6128 - Network Security

Non-DHCP Devices q Can use static bindings in the DHCP snooping binding table Cisco IOS Global Commands ip source binding 0000. 0001 vlan 4 10. 0. 10. 200 interface fastethernet 3/1 q Show static and dynamic entries in the DHCP snooping binding table is different Cisco IOS Show Commands show ip source binding CPSC 6128 - Network Security

Building the Layers q Port security prevents v. CAM attacks and DHCP starvation attacks q DHCP snooping prevents rogue DHCP server attacks q Dynamic ARP inspection prevents current ARP attacks DAI DHCP Snooping Port Security CPSC 6128 - Network Security

Spoofing Attacks CPSC 6128 - Network Security 55

Spoofing Attacks q. MAC spoofing v. If MACs are used for network access Øan attacker can gain access to the network v. Also can be used to take over someone’s identity already on the network q. IP spoofing v. Ping of death v. ICMP unreachable storm v. SYN flood v. Trusted IP addresses can be spoofed CPSC 6128 - Network Security

Spoofing Attack: MAC Received Traffic Source Address 10. 1. 1. 3 Mac B q Attacker sends 10. 1. 1. 1 MAC A Traffic Sent with MAC B Source 10. 1. 1. 3 MAC C packets with the incorrect source MAC address q If network control is by MAC address, the attacker now looks like 10. 1. 1. 2 MAC B CPSC 6128 - Network Security

Spoofing Attack: IP Received Traffic Source IP 10. 1. 1. 2 Mac C q Attacker sends packets 10. 1. 1. 1 MAC A Traffic Sent with IP 10. 1. 1. 2 Source 10. 1. 1. 3 MAC C with the incorrect source IP address q Whatever device the packet is sent to will never reply to the attacker 10. 1. 1. 2 MAC B CPSC 6128 - Network Security

Spoofing Attack: IP/MAC Received Traffic Source IP 10. 1. 1. 2 Mac B q Attacker sends packets 10. 1. 1. 1 MAC A Traffic Sent with IP 10. 1. 1. 2 MAC B Source 10. 1. 1. 3 MAC C with the incorrect source IP and MAC address q Now looks like a device that is already on the network 10. 1. 1. 2 MAC B CPSC 6128 - Network Security

Countermeasures to Spoofing Attacks: IP Source Guard q Uses the DHCP snooping binding table information 10. 1. 1. 1 MAC A Traffic Sent with IP 10. 1. 1. 3 Mac B Nonmatching Is This Is My Traffic Binding NO Dropped Table? q IP Source Guard DHCP Snooping. Enabled Dynamic ARP Inspection. Enabled IP Source Guard-Enabled 10. 1. 1. 3 MAC C Received Traffic Source IP 10. 1. 1. 2 Mac B Traffic Sent with IP 10. 1. 1. 2 Mac C CPSC 6128 - Network Security v. Operates just like dynamic ARP inspection, but looks at every packet, not just ARP packet 10. 1. 1. 2 MAC B

Countermeasures to Spoofing Attacks: IP Source Guard q Uses the information from the DHCP snooping binding table q sh ip dhcp snooping binding Mac. Address Ip. Address Lease(sec) Type VLAN Interface ----------------------00: 03: 47: B 5: 9 F: AD 10. 120. 4. 10 193185 dhcp-snooping 4 Fast. Ethernet 3/18 q Looks at the Mac. Address and Ip. Address fields to see vif the traffic from the interface is in the binding table vif not, traffic is blocked CPSC 6128 - Network Security

Countermeasures to Spoofing Attacks: IP Source Guard q. DHCP snooping has to be configured so the binding table it built q. IP Source Guard is configured by port q. IP Source Guard with MAC vdoes not learn the MAC from the device connected to the switch vit learns it from the DHCP offer CPSC 6128 - Network Security

Countermeasures to Spoofing Attacks: IP Source Guard Configuration IP Checking Only (No Opt 82) What most Enterprises Will Run Cisco IOS Global Commands ip dhcp snooping vlan 4, 104 no ip dhcp snooping information option ip dhcp snooping Interface Commands ip verify source vlan dhcp-snooping IP Source Guard Configuration IP/MAC Checking Only (Opt 82) Cisco IOS Global Commands ip dhcp snooping vlan 4, 104 ip dhcp snooping information option ip dhcp snooping Interface Commands ip verify source vlan dhcp-snooping port-security Static IP addresses can be learned, but only used for IP Source Guard CPSC 6128 - Network Security

Building the Layers § Port security prevents CAM attacks and DHCP starvation attacks IPSG § DHCP snooping prevents rogue DHCP server attacks § Dynamic ARP inspection DAI DHCP Snooping prevents current ARP attacks § IP Source Guard prevents Port Security IP/MAC spoofing CPSC 6128 - Network Security

Attacks on other Protocols (Optional) CPSC 6128 - Network Security 65

Other Protocols? q Yersinia can help you with: v. CDP v. DHCP v 802. 1 Q v 802. 1 X v. DTP v. HSRP v. STP v. ISL v. VTP CPSC 6128 - Network Security

Spanning Tree Basics q STP purpose: to maintain loop-free topologies in a redundant Layer 2 infrastructure A Switch Is Elected as Root A ‘Tree-Like’, Loop-Free Topology Is Established from the Perspective of the Root Bridge Root Selection Is Based on the Lowest Configured Priority of Any Switch 0– 65535 X q STP is very simple; messages are sent using Bridge Protocol Data Units (BPDUs); basic messages include: configuration, topology change notification/acknowledgment (TCN/TCA); most have no “payload” q Avoiding loops ensures broadcast traffic does not become storms CPSC 6128 - Network Security

Spanning Tree Attack Example Root CPSC 6128 - Network Security STP become root bridge P ST q Send BPDU messages to Access Switches X Blocked

Spanning Tree Attack Example Access Switches q Send BPDU messages to become root bridge v. The attacker then sees frames he shouldn’t Ø MITM, Do. S, etc. all possible Ø Any attack is very sensitive to Root Blocked X the original topology, trunking, PVST, etc. Ø Although STP takes link speed into consideration, it is always done from the perspective of the root bridge; taking a Gb backbone to half-duplex 10 Mb was verified Ø Requires attacker is dual homed to two different switches (with a hub, it can be done with just one interface on the attacking host) Root CPSC 6128 - Network Security

STP Attack Mitigation q Try to design loop-free topologies where ever possible, so you do not need STP q Don’t disable STP, introducing a loop would become another attack q BPDU guard q Should be run on all user facing ports and infrastructure facing ports v. Disables ports using portfast upon detection of a BPDU message on the port v. Globally enabled on all ports running portfast Cat. OS> (enable)set spantree portfast bpdu-guard enable IOS(config)#spanning-tree portfast bpduguard CPSC 6128 - Network Security

STP Attack Mitigation q Root Guard v. Disables ports who would become the root bridge due to their BPDU advertisement v. Configured on a per port basis Cat. OS> (enable) set spantree guard root 1/1 IOS(config)#spanning-tree guard root (or rootguard) CPSC 6128 - Network Security