Category: Configuration

Prevent DHCP Server Spoofing by using DHCP snooping

February 21, 2012 Configuration, Security - layer 2

Function of DHCP

On our networks all the different clients will usually obtain their IP address information automatically, using DHCP – Dynamic Host Configuration Protocol. This is faster and more precise than having their IP address information statically configured by manually entering the IP address, subnet mast and Default gateway into PC.

DHCP Attack

DHCP spoofing - All data going accross Attacker PCTo dynamically obtain IP address information, a client makes a DHCP request. A DHCP server sends back a DHCP response in which includes information as an IP address, subnet mask, and default gateway. If an attacker puts and false DHCP server in our LAN network, the rogue DHCP server can respond to a client’s DHCP request. Even if the rogue DHCP server and the actual DHCP server both respond to the request of our PC, the PC will use the rogue DHCP server’s response if it reaches the PC faster than actual DHCP server.

More about DHCP and about DHCP attack here. Let’s se the mechanisms to mitigate the attacks or prevent them fully:

 

DHCP snooping

The DHCP snooping feature on Cisco and Juniper switches can be used to mitigate a DHCP server spoofing attack. With this mechanism switch ports are configured in two different state, the trusted and untrusted state. If a port is configured to be trusted, it can receive DHCP responses. In other way, if a port is untrusted, it is not allowed to receive DHCP responses, and if a false attackers DHCP response attempts to enter an untrusted port, the port will be disabled.

[Continue Reading...]

How to configure CDP – Cisco Discovery Protocol

February 3, 2012 Router Config

In this article we will see how you can easilly configure and tune router CDP capabilities. If you are more interested in what CDP really means and how it works, visit “about CDP” article.

Cisco config

To see simple CD operation and use information that CDP can give you first thing to doo is learn how is possible to turn CDP on and off. If you, for example, want to list the summary information about what devices are connected to your router you can either selectively enable or disable Cisco Discovery Protocol on the entire router, or on individual interfaces. This is done by next couple of commands:

[Continue Reading...]

Mitigate VLAN hopping attack – Get rid of Layer 2 attacks

January 16, 2012 Configuration, Security - layer 2

In this article we will mitigate VLAN hopping by switch spoofing in the way that we will disable trunking on the ports who do not have to become trunk ports. Some Cisco switches ports default to auto mode for trunking. That means that the ports automatically become trunk ports if they receive Dynamic Trunking Protocol (DTP) frames on some of the switch ports.

[Continue Reading...]