Category: Configuration

Prevent DHCP Server Spoofing by using DHCP snooping

Valter Popeskic February 21, 2012 Configuration, Security - layer 2

Function of DHCP

On our networks all the different clients will usually obtain their IP address information automatically, using DHCP – Dynamic Host Configuration Protocol. This is faster and more precise than having their IP address information statically configured by manually entering the IP address, subnet mast and Default gateway into PC.

DHCP Attack

To dynamically obtain IP address information, a client makes a DHCP request. A DHCP server sends back a DHCP response in which includes information as an IP address, subnet mask, and default gateway. If an attacker puts and false DHCP server in our LAN network, the rogue DHCP server can respond to a client’s DHCP request. Even if the rogue DHCP server and the actual DHCP server both respond to the request of our PC, the PC will use the rogue DHCP server’s response if it reaches the PC faster than actual DHCP server.

More about DHCP and about DHCP attack here. Let’s se the mechanisms to mitigate the attacks or prevent them fully:

DHCP snooping

The DHCP snooping feature on Cisco and Juniper switches can be used to mitigate a DHCP server spoofing attack. With this mechanism switch ports are configured in two different state, the trusted and untrusted state. If a port is configured to be trusted, it can receive DHCP responses. In other way, if a port is untrusted, it is not allowed to receive DHCP responses, and if a false attackers DHCP response attempts to enter an untrusted port, the port will be disabled.

[Continue Reading...]

Configuring LLDP – Link Layer Discovery Protocol

Valter Popeskic February 5, 2012 Router Config

In the first article we said some basic things about LLDP protocol and what is he doing. In this part, we will show all commands that can be inserted into Juniper router to make it run LLDP.

[Continue Reading...]

How to configure CDP – Cisco Discovery Protocol

Valter Popeskic February 3, 2012 Router Config

In this article we will see how you can easilly configure and tune router CDP capabilities. If you are more interested in what CDP really means and how it works, visit “about CDP” article.

Cisco config

To see simple CD operation and use information that CDP can give you first thing to doo is learn how is possible to turn CDP on and off. If you, for example, want to list the summary information about what devices are connected to your router you can either selectively enable or disable Cisco Discovery Protocol on the entire router, or on individual interfaces. This is done by next couple of commands:

[Continue Reading...]

Protecting Against STP Layer 2 Attack

Valter Popeskic January 19, 2012 Configuration, Security - layer 2

There are two main protection mechanism against attack on STP process, Protecting with Root Guard and Layer 2 Protecting with BPDU Guard. Let’s see how is that working…

[Continue Reading...]

Mitigate VLAN hopping attack – Get rid of Layer 2 attacks

Valter Popeskic January 16, 2012 Configuration, Security - layer 2

In this article we will mitigate VLAN hopping by switch spoofing in the way that we will disable trunking on the ports who do not have to become trunk ports. Some Cisco switches ports default to auto mode for trunking. That means that the ports automatically become trunk ports if they receive Dynamic Trunking Protocol (DTP) frames on some of the switch ports.

[Continue Reading...]