- Types of Layer 2 Attacks
- CAM Overflow
- VLAN Hopping
- MAC Spoofing
This chapter is from the book
This chapter is from the book
This chapter is from the book
CAM Overflow
Switches operate by building a reference table of MAC addresses and corresponding switch ports. Based on the destination MAC address, the switch knows which port to forward the frames to. This table is called the context-addressable memory (CAM) table.
The switch can hold only a specific number of MAC addresses in this table, depending on the resources available to the switch.
A CAM overflow attack occurs when an attacker connects to a single or multiple switch ports and then runs a tool that mimics the existence of thousands of random MAC addresses on those switch ports. The switch enters these into the CAM table, and eventually the CAM table fills to capacity. When a switch is in this state, no more new MAC addresses can be learned; therefore, the switch starts to flood any traffic from new hosts out of all ports on the switch.
A CAM overflow attack turns a switch into a hub, which enables the attacker to eavesdrop on a conversation and perform man-in-the-middle attacks.
A common tool that performs CAM overflows is macof and is part of the Dsniff set of tools. This tool generates hundreds of thousands of random MAC addresses and floods these out onto the network. This is a useful tool for testing to see if your switch infrastructure is susceptible to CAM overflow attacks.
Cisco implemented a technology into IOS called Port Security that mitigates the risk of a Layer 2 CAM overflow attack.
Port Security
Port Security on a Cisco switch enables you to control how the switch port handles the learning and storing of MAC addresses on a per-interface basis. The main use of this command is to set a limit to the maximum number of concurrent MAC addresses that can be learned and allocated to the individual switch port.
If a machine starts broadcasting multiple MAC addresses in what appears to be a CAM overflow attack, the default action of Port Security is to shut down the switch interface; although, you can configure the switch just to discard any future Layer 2 frames received from the bogus MAC addresses.
Configuring Port Security
You must configure Port Security at the interface configuration level on a Cisco IOS switch. You need to allow Port Security on static access ports rather than dynamic access or trunk ports.
For illustrative purposes, this section shows a common Port Security configuration. You can configure Port Security to dynamically enable three MAC addresses on the configured port and make these connections sticky.
Start by ensuring that the switch port is a static access port:
Switch(config-if)# switchport mode access
The next step is to allow Port Security on the switch interface and to configure a maximum of three MAC addresses for the interface:
Switch(config-if)# switchport port-security Switch(config-if)# switchport port-security maximum 3
The switch learns the MAC addresses connected on the switch port and enables the first three it finds. In most cases, it is only a single end-user workstation connected to the switch and should see only a single MAC address. The switch needs to go through this process whenever you reboot the switch. You can allow the sticky mode for Port Security so that the MAC addresses that the switch learns about are stored when the configuration is saved so that they do not need to be relearned when the switch reboots. To allow sticky learning, enter the following command:
Switch(config-if)# switchport port-security mac-address sticky
You just reviewed a common configuration scenario in which the switch dynamically learns and remembers the MAC address of the devices connected to it. The other, and more secure, mechanism is to configure static Port Security by manually specifying the MAC address of the host connected to it.
If you have a switch port with the host MAC address 00:16:cb:96:95:94 connected to it, you can enter the following command to ensure that only this host can connect to the switch port:
Switch(config-if)# switchport port-security mac-address 0016.cb96.9594
The default mode of port-security operation is to shutdown the port. There are three configurable modes of operation for port security - Shutdown, Restrict and Protect.
In the event that the switch port receives more MAC addresses than the configured maximum the port-security mode of operation dictates the action taken by the switch.
Shutdown. In the event that the switch port receives more MAC addresses than the configured maximum, the switch will shutdown the switch port. This is the default action mode.
Restrict. Restrict drops packets from unknown source MAC addresses received on the switch port and sends an SNMP Trap or a Syslog message to an administrator. The violation counter is also incremented.
Protect. Protect drops packets from unknown source MAC addresses. No SNMP Trap or Syslog message is generated and the violation counter is not incremented.
The following command is used to change the port-security mode of operation:
switchport port-security violation {shutdown | restrict | protect}