In this video I'll show you how to completely break a LAN Switch.
We’ll use an attack called Mac Flooding of type Denial Of Service.
This is an extremely easy DoS attack to launch on any Ethernet Switch from a Linux Machine.
Let’s dive deeper into this attack and see how it works! Switches maintain a MAC Address table that
maps individual MAC addresses on the network to the physical ports on the switch.
This allows the switch to direct the data out of the physical port where the recipient is located.
Let's take a look at this image!
There is a 3-port Switch and a PC connected to each port.
To exchange frames between networking devices efficiently,
the Switch will dynamically construct a MAC Table using the source MAC address of the received
frames and the incoming port.
In this example when Host1 or H1 sends a frame, the Switch
will learn that the MAC address of H1 is connected to port1 and it will map the MAC address of
H1 to port 1.
This process is called Mac learning!
Then, when the switch receives a frame for the destination MAC address of H1, it will forward
the frame out of port 1 only, because the MAC of H1 was learnt and associated with port 1.
On the other hand when the switch receives a frame for destination MAC address that is not in its Mac
table
it will flood the frame out of all the LAN ports of the same VLAN except for the port that received
the frame.
Note that the dynamically learned MAC addresses are deleted after the MAC address age value has
expired.
In many cases the default value for aging the MAC address is 300 seconds.
So if a MAC address is not seen within 300 seconds it will be deleted from the Mac table.
This is basically how a Layer 2 Switch works! The MAC flooding attack will exploit the vulnerability resulting
from the basic operation of a switch.
It lies in the fact that the size of the Mac table is limited and once this table is filled there will
be no space for MAC addresses of new devices that are trying to communicate.
Subsequently the switch will start to act as an Ethernet HUB, meaning it will forward traffic to
all physical ports.
A malicious user can use a packet sniffer, like Wireshark, to capture sensitive data being transmitted
between other computers which would not be accessible when the switch operates normally.
Okay, let's exploit the Switch!
This is the topology I’m going to use: My laptop runs Windows 10 and Kali linux in a VM.
You can also use another Linux distribution like Ubuntu or Linux Mint.
The Linux machine is connected directly to a Cisco Catalyst Switch using a wired Ethernet connection.
If you use the same setup don't forget to set the VM network in bridged mode so that the Linux machine
has access to the physical interface of your laptop.
To reproduce this attack besides a Linux operating system you need a layer to switch.
You will connect to the Linux machine to the swich using a wired connection.
Now if you don't have available such a physical switch you can still launch this attack.
Just run a CiscoL2 IOU image
in GNS3 and set up a network connection between the Linux host and the devices that run in
GNS3.
Something like in this image.
Take a look at the previous lecture where I've explained in detail how to do that.
The tool I'm gonna use to launch the attack is called the Macof which is part of a package called D
SNIF.
This is its man page.
Macof will flood the switch with hundreds or thousands of Ethernet frames, with random source Mac addresses
per second.
This will fill in the switches Mac table, though the new Mac addresses cannot be saved and the switch starts
to send all packets to all ports.
Moreover the Mac flooding attack could freeze or make the switch to restart because it will continuously
learn new Mac addresses and age the old ones.
In fact the switch
CPU utilization will be almost 100% during the attack. We’ll put the switch under a lot of stress!
This is a console connection to the switch and let's take a look at the switch
CPU and the MAC address table before starting the attack.
Enable I am becoming admin show process
CPU sorted
and the output is showing us that for the past 5 seconds the CPU usage was just 4% and the MAC
address table of the switch: show mac address table
and we notice that there is only one dynamically learned MAC address on Port fast.
ethernet0 /1 . This is the port to which my laptop is connected.
Perfect, let's start of the attack on the switch!
The first step is to install this sniff that contains Macof, the tool
we are going to use. This package is not already installed in Kali Linux but it belongs to the standard
repositories of both Kali and Ubuntu.
So apt install dsniff. I've already installed it so it's already the newest version; don't forget
that in order to install dsniff and lunch the attack you need a user with root privileges.
Okay.
Dsniff is installed.
Let's start macof. All I need is the name of the outgoing interface,
the interface that will be used to flood the switch.
I'm running ifconfig and I notice that the interface is called eth0.
Of course you can see another name and you should use it accordingly.
So macof -i eth0 and I'm hitting enter ; macof has started to flood the switch with
random mac addresses at wire speed.
Now let's return to the switch to see the damage we have done
show mac address table count and we see that the switch has already learned
7992 MAC addresses; the MAC address table of the switch is already full
with thousands of bogus MAC addresses.
Just take a look what's here!
There are thousands of fake MAC addresses.
Let's take another look at the Switch CPU utilization: show process CPU sorted
And we notice that the CPU utilization for five seconds is 66%.
The switch is under a lot of stress, now probably is working as a hub,
flooding all frames it receives out of all ports; and if we continue the attack the switch could simply
crash or reboot.
I've just shown you how to break thisCisco Enterprise Switch in just a few seconds using Linux and
the common tool like macof.
Keep in mind that this is not a Cisco specific attack but an attack that could be launched on any Switch!
In the next lecture
I'll show you what countermeasures you can take as a network administrator to protect your land infrastructure.
See you again in two seconds.