OK I’ve just shown you how a script kiddy could destroy your multi-thousand dollar Cisco Enterprise
class Switch.
But what can you do to protect your network?
One way to avoid the dreaded CDP flood attack is to disable CDP on the entire switch. Let’s do it!
This is the console connection to the switch: config t and the no cdp run. CDP was disabled
globally: do show cdp traffic
And you notice that CDP is not enabled.
However sometimes you don't want to disable the CDP entirely.
Another way is to pick specific interfaces and disable CDP on those interfaces only: do show ip interface
brief.
Let's see the interfaces! okay!
And I want to disable CDP on FastEthernet0
/1: int FastEthernet 0/1 no cdp enable. I've just to disable the CDP on
that interface only. But what if you don't want to disable CDP at all?
In fact it's a useful protocol that's why it exists and is enabled by default on Cisco devices.
Another more viable option is to enable port security on the switch.
This will protect the switch by limiting and identifying MAC addresses that are allowed to access a
port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached
when a new MAC address is attempting to access the port,
a security violation occurs and by default of that security violation means shut down the port.
You will not only protect the switch against this attack and many others but you will also find out
where the attack was launched from.
And of course the switch continuous to work as expected.
We could have an entire discussion on port security but it's not the topic of this lecture.
Okay, let's launch the CDP DoS attack again!
I'm going back yersinia lauch attack
flooding CDP table and
Okay!
The attack is running! Let's
check the switch CPU utilization again.
I'm executing the same show process cpu command
and the CPU utilization for 5s is only 5% ; when CDP was running it was 99 % so it's
a big difference.
Congratulations you've just learned how to protect your Cisco devices against CDP attacks!