Author: Valter Popeskic

SPAN – Switched Port Analyzer technology and configuration

February 28, 2012 Configuration, Security - layer 2

In simple words SPAN technology enables port mirroring on selected switch.

In some cases you will need that some kind of server, PC or other network device receives a copy of network traffic that is destinated for some other device in the network. Why would you want that? Maybe you need some kind of control of the traffic or you want to implement IDS – Intrusion Detection System or something else. In that case you can configure every Cisco switch to send a copy of the traffic to one of the ports that is connected to sensor device.

[Continue Reading...]

Prevent ARP Spoofing using Dynamic ARP Inspection – DAI

February 23, 2012 Configuration, Security - layer 2

Additional protection of potential man in the middle attack
Dynamic ARP Inspection will help us prevent Address Resolution Protocol – ARP spoofing attacks with help of DHCP functionality and specially DHCP snooping. This is why  Dynamic ARP Inspection is usually used simultaneously with DCHP snooping. Let’s se how is this technology protecting us from ARP attack.

[Continue Reading...]

Spoofing Attacks – ARP Spoofing

February 22, 2012 Security - layer 2

How attacker can launch man in the middle attack using ARP spoofing and what is ARP spoofing?
Attackers can attempt to launch an attack by sending gratuitous ARP – GARP replies. GARP reply messages are sent from some device in the network to other without the prior receiving of a request for sending a ARP reply. Is an ARP reply without cause. This reply without cause can tell network devices that the attacker’s MAC address corresponds to specific IP addresses that is actually IP address of some other device in the LAN.

[Continue Reading...]

Prevent DHCP Server Spoofing by using DHCP snooping

February 21, 2012 Configuration, Security - layer 2

Function of DHCP

On our networks all the different clients will usually obtain their IP address information automatically, using DHCP – Dynamic Host Configuration Protocol. This is faster and more precise than having their IP address information statically configured by manually entering the IP address, subnet mast and Default gateway into PC.

DHCP Attack

DHCP spoofing - All data going accross Attacker PCTo dynamically obtain IP address information, a client makes a DHCP request. A DHCP server sends back a DHCP response in which includes information as an IP address, subnet mask, and default gateway. If an attacker puts and false DHCP server in our LAN network, the rogue DHCP server can respond to a client’s DHCP request. Even if the rogue DHCP server and the actual DHCP server both respond to the request of our PC, the PC will use the rogue DHCP server’s response if it reaches the PC faster than actual DHCP server.

More about DHCP and about DHCP attack here. Let’s se the mechanisms to mitigate the attacks or prevent them fully:

 

DHCP snooping

The DHCP snooping feature on Cisco and Juniper switches can be used to mitigate a DHCP server spoofing attack. With this mechanism switch ports are configured in two different state, the trusted and untrusted state. If a port is configured to be trusted, it can receive DHCP responses. In other way, if a port is untrusted, it is not allowed to receive DHCP responses, and if a false attackers DHCP response attempts to enter an untrusted port, the port will be disabled.

[Continue Reading...]