In this section, I will describe how two basic attacks,
simple MACs moving and MAC address table flooding work.
Then you will learn how the basic features of port security
can help reduce or prevent these attacks along with other ARP
based threats from this module.
To understand the attacks and countermeasures,
let's first look at the basic functions of switches,
MAC address learning, and data forwarding.
Switch MAC address learning is core to the function of switching.
Switches dynamically associate the MAC addresses of any attached devices
with the port to which they are connected based on the source MAC address
of packets passing into the physical interfaces.
They, therefore,
allocate memory and buffer locations called the content
addressable memory for this purpose.
There is, of course, a limit to the space and number of allowed MAC addresses.
The maximum addresses for any switch, switchport,
or VLAN is based in the vendor's implementation and the hardware.
Here, we have a switch that has learned MAC A on port 1.
As our attacker connects to the network,
the switch dutifully associates the MAC C with port 2 increasing the
total count of MAC addresses to 2 out of a maximum of 4,
196.
What is interesting is what happens when the content
addressable memory and MAC address table are full.
Some older switches have a peculiar behavior that they start flooding the
network with all traffic they receive regardless of addressing.
This means that whether incoming packets are MAC broadcast,
multicast, or unicast, they are flooded out all active ports.
This essentially turns our nice switch into a hub.
A MAC table flood attack takes advantage of this,
software used to continually fill the CAM and MAC tables as shown here.
Once the maximum has been reached,
the switch floods all traffic creating a privacy issue and a loss of
confidentiality of any unencrypted data traversing the switch.
On affected switches,
this attack could be used to view flooded data or
potentially as a form of Denial of Service attack.
These then could lead to more sophisticated attacks such as ARP poisoning
and man-in-the-middle attacks shown later in this course.
Port security is an effective and common countermeasure which can
be enabled on a per port basis on switches.
Port security's basic function is to validate and authenticate
devices to physical ports based on MAC address.
A maximum number of MAC addresses are dynamically
learned or statically configured per port.
When the source MAC address found on a port is different from
any port security identified MAC addresses,
or when the maximum number of allowed MAC addresses on a port is exceeded,
or when a secure MAC address configured on a port is
found on another secure port in the VLAN,
a violation occurs.
A violation action is set on the port and determines what happens in that event.
Commonly,
the port is shut down or ingress traffic is restricted and not allowed to flow
until the violation has been removed and the port recovered.
Recovery from a violation may require administrator
intervention or may allow automatic recovery once the
violation state has been corrected.
In the example here, port security has been enabled on ports 1,
2, and 4 and not on port 3.
Port 1 has a preconfigured secure Mac address of A
and port 2 has E and D allowed.
Port 4 has not yet learned or had a secure MAC address statically programmed.
Each of the secure ports has had a maximum number of
allowed MAC addresses configured.
The default is usually 1 helping to prevent port
sharing through added hubs and switches.
Port 2 has a maximum of 2 preconfigured while Port 4 would
allow 5 maximum secure MAC addresses.
Persistence would allow the secure MAC addresses to remain
configured including through a system reboot.
Without persistence,
MAC addresses may be allowed to age out after a configurable
amount of time and new ones to be dynamically learned or
cleared if the switch reboots.
When an unknown device connects at port 2,
ingress traffic shows the source MAC C does not match any of the
configured MAC addresses and a violation occurs.
Dependent on the configuration,
the port may be allowed to recover automatically after a timeout period
or may require administrator overhead to recover.
With Cisco switches,
the latter is the default and an administrator manually needs to
intervene by shutting the port down and reenabling it.
This is good in more secure environments as it alerts
staff to investigate the cause.
However, in more variable environments,
it could create an undue amount of tickets and administrator overhead.
You can see port security blocks many attacks including ARP
based ones by validating devices in the network.
Like any other security measure, there are ways around it.
In this case,
our attacker has learned that allowed MAC addresses on Port 2 includes E and D.
After any violations were cleared,
the attacker changes their local MAC address and connects.
This MAC spoofing attack does not create any violation and our attacker now
wishes to try the CAM table flooding attack shown earlier.
Once initiated, the maximum allowed MAC addresses on the port has been exceeded,
a port security violation occurs, and the shut down action is taken.
In this way, port security again has reduced the threats in the network.
As you've seen here,
switch MAC or CAM table flooding attacks creates serious privacy issues as
overloaded switches flood all traffic out all active ports.
A common countermeasure is port security.
This is a network port-based authentication which validates
based on MAC addresses of connecting devices.
By default,
most port security implementations limit the maximum
allowed connected MAC addresses to one, but this is a configurable option.
Port security's secure MAC addresses can be learned through
static configurations or dynamically.
They can be persistent through reboots and disconnections or be
allowed to time out if an aging timer is set.
If a violation condition occurs through an incorrect
MAC address being attached to a port,
a port security MAC address associated with one port
appearing in another port in the same VLAN or exceeding the
maximum allowed MAC addresses on a port,
then ingress traffic is blocked.
Recovery of any port security violations either requires
administrator overhead or an auto recovery mechanism be set.
Finally,
one of the limitations of port security is that it can be circumvented through MAC address spoofing.