In the last lecture we've seen how to destroy on Ethernet switch using DoS
attack called MAC Flooding! In this lecture
I'll show you what countermeasures you can take to protect your network.
The first thing I want to tell you is that you can avoid this attack only if your switch has some build-in
security features in its operating system and allows a basic management.
If you have a home user transparent switch, that can only be turned on and off,
there is no way to protect it against Mac flooding.
Fortunately all vendors that produce professional devices have included in their switches some security
features against this type of attack.
For this lab we have this Cisco Catalyst Switch. The countermeasures for Mac flooding is to configure
a security feature called port security on the switch.
This will limit the number of a MAC addresses the switch can learn on each interface or port. A MAC address
configured by port security is called a secure MAC address and there are three types of secure
MAC addresses: static secure MAC addresses, dynamic secure micro addresses and the sticky secure MAC addresses.
Static secure MAC addresses are manually configured MAC addresses that are stored in the MAC
address table and added to the switch running configuration and saved
after a restart. The second category Dynamic secure MAC addresses are dynamically learned MAC addresses
stored only in the address table and removed when the switch restarts. And Sticky secure MAC adresses
are dynamically learned or manually configured stored in the address table and added to the running configuration
so they are also available after the switch restarts. If these addresses are saved in the configuration
file
the interface does not need to dynamically lern them again when the switch restarts.
Perfect! When the maximum number of secure MAC addresses have been reached
a security violation occurs.
The switch can react to a security violation in three different ways:
protect, restrict and shut down. Let's see what does "protect" the mean! When the number of secure MAC addresses
reaches the limit allowed on the port packets with unknown source addresses are dropped
until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowed
addresses.
There is no notification that a security violation has occurred. Then "restrict"
it's the same as protect just that a notification of type SNMP
trap a syslog message is logged, and the violation counter increments. And the last security
violation is "shutdown" which is also the default mode. In this mode a port security violation causes
the interface to immediately become error disabled.
It also sends an SNMP trap,
logs a syslog message, and increments the violation counter. When a secure port is in the error-disabled
state,
one way you can use to bring it out of it is to manually re-enable the port to by entering the shutdown
and no shutdown interface configuration commands. I'll attach a comprehensive resource on port security
to this lecture. Let's return to the switch and enable port security for the interface to which the attacker
is connected. Let's see the switch interfaces sh ip int brief
The interface to which the Linux machine is connected is FastEthernet0/21 We notice that's
the only interface enabled. I am entering the interface configuration mode. conf-t interface fastethernet
0/1 Port security works only on an access port so I set it as an access port: switch
port mode access and I am enabling port security on the port: switch port port security and I'll set
the maximum number of secure MAC addresses for the interface to 5 switch port port security maximum
5 and I want the interface to become error disabled when a violation occurs.
This is by the way the default: switch port port security violation and we have protect restrict and
shutdown. Let's lunch the Mac flooding attack again! I'm going to Kali Linux and I am executing the last
command.
Let's return to the switch and we notice that the switch has immediately shutdown the interface fast
Ethernet0/1: port security violation error putting Fa0/1 error disable
state
The security violation has occurred after five frames with random source MAC addresses have
been sent to the switch. The attack is running but the switch is not affected anymore.
Let's see the MAC address table and CPU utilization. From privileged exec mode
I'll execute show MAC address table
and there is no dynamic Mac learned by the switch; the interface to which the attacker is connected
was shot down.
See the CPU utilization
and we notice that the switch CPU is idle. The CPU utilization is only 5 %
show interface F0/1 shows us that the interface is in error disable state.
Now I know that the attack was launched on Port F0/1 slash 1. If I want to enable the port I can
do it manually like this. I'm going into interface configuration mode and I'll execute 2 commands: shut
down and no shut down. But first I'll stop the attack, otherwise port security will shut down the port again:
so shut and no shut
and the the interface changed state to up. Okay! Another way to protect against the Mac flooding attack
is to implement IEEE 802.1X authentication.
This allows packet filtering rules issued by a centralised AAA server, such as a Radius server,
based on dynamic learning of clients. Congratulations, you've just learned how to protect your switches
against Mac flooding attacks!