Hello, guys, and welcome to another video on this chapter.
This is the beginning of Internet, we have been facing constantly increasing threats,
which can affect the stability and usability of the networks.
Nowadays, businesses rely on their networks and the Internet more and more.
So in order to defeat such attacks, we need to really understand how the work.
Mac Flooding is one of the most common network attacks and like other Web attacks
. Mac Flooding is not a method of attack in any host, particularly the network, but
is the method of attacking the network Switches.
However, the victim of the attack is the host computer in the network.
We're going to see what the Mac flooding is and how we can prevent it.
The Mac flooding
is an attack method intended to compromise the security of the networks, which is
usually the switches maintain a table structure called mactable.
This Mac table consists of individual mac addresses of the host computers or the
network which are connected to the ports of the Switch.
This table allows the switches to direct
the data out of the ports where the recipient is located.
Perhaps in this lesson I am assuming that
you know what happens, but I am going to offer some information
in regards to that so you can understand thoroughly. We have
Broadcast the data to be Internet the entire network, allowing
the data to reach a host on the network, which is though send the data to the
specific machines which the data is intended to present.
This goal is achieved by the use of Mactables the aim of the mac flooding
Attack does is to take down this mac table in a typical floodin Attack.
The Attacker estimates range in a huge number. In send
many user internet switches, this frames will have BIOS sender address.
The intention of the attacker is
consuming the memory of the Switch that is used to store the Mac addresses table.
That's the Mac address table becomes full
and it is unable to save new Mac addresses.
It will lead the Switch passing will lead the Switch to enter into
a fail open-mode and the Switch will now behave same as a network hub.
So let's see what are the benefits of the attacker with the Mac flooding?
Attack Attack.
It is a part of the network, the Attacker.
Can we also get the data packets intended
for the victim machines or so that the attacker will be able to steal
sensitive data from the communication of the victim and other computers?
Usually a packet analyzer is used to capture these sensitive data
after launching the mac flood Attack successfully the Attack.
You can also follow up with an Directory Spoofing Attack.
This will help the attacker retaining access to the previous data even after the
attack, which is recovered from the flooding Attack.
So to perform this attack, we are going to use command macof in Kali linux.
macof is a member of the Disney offshoot to set and mainly used to
flood the switches and local network with mac addresses.
So these two types of flooding attacks,
the symbol flooding and the targeted flooding.
So the first.
Command is macof -i -n 10
and you to the Network, you would like to send the
mac flood Attack to each one and retargeted flooding Attack
is when you when the random Mac addresses are testing to a specific destination IPS.
So therefore it's macof -i -n 10 which is
the network 0 eth1 and then space dash D
lag and then you provide the destination IP be the target.
It would like to attack the.
We're going to see both of those attacks and we are going to perform
it IN KALI linux while having Wireshark aside.
And we're going to see how everything is
behaving and how we can see that in Wireshark.
So we are in our Kali Linux machine and we are ready to demonstrate.
And Attack and see how that will be shown in Wireshark.
So let's just go ahead in our terminal and type, macof
-i as we said then, we are choosing the network in this case is ethzero for us.
You can see it on Wireshark.
If you would like to learn it, you can just go ahead and type.
Ipconfig, of course, and then you will see it here.
Sort of just clear out and type again. -i macof
then we are choosing our network and let's be from this Attack first and
then we are going to do the targeted flooding later on.
And you can see how the.
Wireshark will capture the whole traffic
in our targeted message later on, but perform this Attack first that capturing
on the desired network and then from the Attack.
So you can see there is a lot of like Mac addresses.
Going by this time, the switches is already flooded, I guess, after, like a
few seconds and you can see in real time here in Wireshark, there is all sorts of.
Like it's coming, so before we stop the Attack, you can see that.
Let's say that there is an opportunity for you, your capturing packets,
so you're investigating something, are you exploring something
on wireshark while this is happening, so while you're exploring something and you.
While you're exploring something else and you see some packets
coming out like that and there is no information.
That means that means you are under mac flooding Attack your network is
so you can see the source and the destination completely like random.
And the only purpose is to fill up the mac address, you can see that.
So as soon as we stop this Attack.
You can see that the traffic will go back to normal.
So the stop this capture.
So now if you have let's say you have pcap file that you have saved.
So let's say that you have a pcap file
that you have saved, but then some network traffic from your
Web server or from your company or from a specific network.
So usually there is a lot of data coming in and out of machines to the network.
So it's hard to go through each by one line.
So usually what I do is, as you saw, there is no information when it's not happening.
And if you see random addresses, the only
thing that you can do, just be categorized by Info.
And know it's going to take a little bit of time.
You can see if I press enough again, so
this will categorize everything by information.
So there you go. You have it.
You have all the packets going back and forth from my source, IP to
any destination IP they have no information on.
This is usually traffic that it's uploading the switch in the network.
But not everything, and now we can see how everything will behave.
And we are going to flood the Switch with random mac address
destined t o specific IP address, so let's say that
we are lets type the same command, and this time we're going to use the.
We're going to use additional dash D flag and then we are going to choose.
Our target.
Let's choose this target.
Start capturing.
And perform the Attack.
So you can see in real time here in Wireshark, that is a lot of random.
Mac address is specifically going to that
IP address that we have typed in our command macof command.
So go ahead and stop the Attack
you can see again that the traffic will go back to normal.
Let's stop the capture and again, you can use the same methods as before.
Like we said, if you have a lot of
packets and traffic captured in a big pcap file that you have saved from.
captured from your business, from your
Server or from your from your computer network, you can just.
No doubt buy in for or in this case,
let's say you can choose a specific IP address that you may suspect that there is
a destination of this random mac addresses.
And in this case, you can use the IP dot.
Like that.
So you have now all the packets going to a
specific destination, this 8 dot one eight six, that was the target of our
flooding Attack and now since the Python Server reduced to a significant amount.
And to the ones that not only destined to a specific IP address
that we have set out in our display filter, there, you can see.
Now in the same manner.
If they use the info, you can see that started some traffic normal and then.
Random mac addresses appear to have a specific destination IP
here, some of the major counter measures against Mac flooding our port security.
The are configured to limit the number of Mac addresses that can be learned.
to ports are connected to the station.
The implementation of 8 zero two point oneX.
Allows PACKETS, gets this implementation, allows packets
filtering rules issued by a centralized AAA Server based on dynamic learning of
clients AAA Server or Deep learning Server is a Server program that handles user
requests for access to computer resources and for an enterprise, provides
Authentication authorization and thus the to play this.
In this method, they discovered Mac addresses are
authenticated against an Authentication authorization, an accounting Server and
this addresses are subsequently filtered also mac filtering, where there is
a limited number of Mac addresses being set.
So that was it for this video.
I hope it was informative enough.
When you're ready, you can go ahead and click on the next video.
What are you going to learn?
How to detect ARP Cache Poisoning Attack with Wireshark.