It is critically important that we understand Mac address attacks, so let's get to work on it right
now in a network.
Well, here we are in a layer two topology.
And what would happen if we went to this device?
Think about it.
If we went to that P.C. that's attached to this device and we went and we flooded the MAC address table.
The MAC address table is also known by the name the cam, the content addressable memory on the switch.
If the cam fills, it's finite in size by default, of course, by design it's that way.
If it fills, then legitimate MAC addresses can't be learned.
And when people are trying to communicate with those legitimate MAC addresses, the traffic will be
flooded and therefore perhaps intercepted by the eavesdropper.
So this is a terrible situation.
What we can do is we can lock down with port security, the ports based on Mac address.
So this is the legitimate Mac address of PC one.
So what I'm going to do is I'm going to copy that to the clipboard now.
I'm going to show the running configuration for the fast Ethernet interface 0/4.
Yeah, that's right.
We can't actually do show run interface on this simulator.
I don't like that at all, but that's okay.
I'll just go in and manually look at it's in its default configuration.
All right.
So we're going to go to that fast Ethernet zero, slash four, and we're going to put in place port
security.
Watch this.
We're going to say switch port mode access.
That's the first thing we're going to do.
We're going to make sure we are in access sport mode and then we're going to say switch port, port
security mode, shutdown.
This is going to ensure.
Yeah, I don't think it's mode.
I think it's violation.
There we go.
Shutdown.
So it's the violation command asset violation mode of shutdown.
If there is a mac address that shows up on this interface, that isn't the one that we're going to secure
it down, lock it down to, then this interface will shut down.
What great security will then say switch port.
Mac?
No maximum.
Come on, Anthony, you can do it.
Switch port.
Port security, maximum one.
To say we only want one knock address.
Then we're going to say switch port, port security Mac address and let's paste it in.
So we are locking down this switch port to that Mac address.
Now, last thing, we have to turn on the feature switch port, port security.
Believe you me, that is very difficult to remember.
You're going to set the violation mode.
You're going to set the maximum.
You're going to set the Mac address.
And then you're going to be like, okay, I'm done.
It's so easy to forget to turn on the feature and you don't want to turn on the feature until you've
got all the parameters set.
So the way I did it is the best practice recommendation, but it's easy to forget to turn on the feature.
That's why I always verify.
So I will do a show Port Security Command, to make sure it's set properly.
And let me just expand this so you can see it better in formatted view there, where fast Ethernet 0/4
is set for one secure MAC address.
Currently there is one address on the interface and it is the exact address of PC one.
And what would happen if there's a violation?
Well, this device would shut down this interface.
Hey, let's test port security.
Why don't we if we come over to this machine and we go to the.
Would it be under IP properties?
Yes.
Look at the.
No, that's the link.
Local IPV six address.
I got all excited, I saw the hacks and I thought that was the Mac address.
Knew.
That's the IPV six address.
All right.
Oh, we're getting close here.
And we're getting close.
Look at this.
There's the Mac address.
So we are going to change the Mac address now on this host and that should trigger a port security violation.
And look at that.
That interface just shut down.
You can see I tested this earlier over here.
Yeah.
So that interface just shut down.
Wow.
We had a port security violation.
And look at this.
If we go to the device, we can see that there is the interface taken down.
Let's see if we missed any log messages.
Nope.
So that is not realistic to the port security feature because there would have been absolutely a ton
of log messages associated with that event.
Show log buffer?
No.
All right.
So anyways, yeah, we would have seen the port security violation messages right at the console.
Trust me.
But we saw the security feature doing its job and we should verify it with show port security?
Yes.
Now we can see there is a security violation.
Hey, I wonder if it's smart enough to bring itself back up.
Let's check it.
So we will go in and we will change the Mac address back to the correct Mac, and that will start showing
up on the interface.
And let's see what happens.
Let's do a show.
Mac address.
I don't think this is going to have any any effect.
Yeah.
Because the interface is shut down.
Uh.
Let's see.
So, port security.
And yeah, it's going to stay in that shut down state.
Now, we could bump it along here by shutting it down administratively, shutting it down and then no
shutting it.
So that's going to bring the interface completely down.
Bring it back up.
The correct Mac address is now on the interface.
So everything will start functioning again.
I can do the same thing up here where I was experimenting with the feature.
I can go in and say shut and no shut.
And that should bring things back to life where we had another port security violation.
So what an incredibly powerful feature.
One that I want you practicing with and one that I want you, you know, fully understanding by locking
down a switch port to the single Mac address that is legitimately supposed to be there.
And maybe if that person has a voice over IP phone, you're going to go ahead and lock it down to those
two MAC addresses.
Oh, my gosh.
That is going to foil such a huge number of attacks associated with MAC addresses and other levels.
Like how about DHS CP based attacks that would also leverage Mac addressing.
Those are all foiled as well.