Hello,
and welcome to this demonstration on switch MAC address table flooding attacks.
I'll be showing you how the Ubuntu Linux tool MACOF can be used to flood
a switch's content addressable memory and MAC address table is part of a
Denial of Service attack or a sniffing attack used to force older
switches to flood all received traffic.
Then I will show you how various port security configurations can
be used to validate systems to the network limiting connections to
devices with approved MAC addresses,
as well as limit the maximum number of devices attached to any given switchport.
You will learn the difference between using manual recovery and automatic
recovery from violations along with other port security configurations you
can use to harden your network for MAC flooding,
ARP based, and other types of attacks.
In this demonstration layout, I will be using a Cisco 1841 router at 20.
1.
1 connected through a Cisco 3750 switch to a Windows host at 20.
1.
2.
The Windows host will contain an Ubuntu VM and they will both share
a connection to the switch on FastEthernet 9.
Using the Linux tool, MACOF,
I will demonstrate the MAC flood attack on the switch.
You will see how this affects the MAC address tables on the switch.
From here,
I will show you the default port security configurations available
on the 3750 switch and demonstrate how various port security
options can be used to secure your network.
Let's start by opening the switch command prompt and viewing
the dynamic entries in the MAC address table.
There are just a few MAC addresses on VLAN 1 and 20 including my
Windows host and Ubuntu VMs on FastEthernet 1/0/9.
In total, there are eight dynamically learned MAC addresses.
To understand the limit of the MAC address table and
the content addressable memory,
I will use the show mac address table count command.
Here we can see there are 5 dynamically learned MAC
addresses on VLAN 1 and 3 more on VLAN 20 leaving a total
MAC address space available of 5, 503.
Remember that the MAC flood attacks take advantage of some
network systems by filling this memory.
Depending on the make, model, and age of switches you have,
this attack could have various results.
It might not have any appreciable effects as with many modern
enterprise switches or it might make the switch behave as a hub
flooding all traffic out all active ports or it could act as a
type of Denial of Service attack.
Regardless, let's take a look at how port security is used,
not just to block MAC flooding attacks,
but as a way to authenticate devices to the network and
limit many other cyber security risks.
Here we have the Ubuntu terminal.
First, take a look at the MACOF command help information.
It's a pretty simple command which can be run on its own
or with just a few simple options.
In this case,
I'll run it with a -i to specify the interface on
which I want the command to run, my ens33 interface.
When I hit Enter, the command starts flooding the network with random IP traffic.
This forces the switch to add each of the source MAC
addresses in these frames to its MAC address table eating
up that content addressable memory, or CAM.
Let's return to the switch to see how that looks.
Immediately, I can notice that my switch prompt is unavailable.
Let's go back and stop my MACOF attack and take a look at what happened.
Here were getting updates from the console telling us that the MAC address
learning process is taking up more than its share of the CPU.
Let's go back and start our attack and see if we can get the switch to respond.
Now that we have the switch command prompt,
let's take a look at that MAC address table count.
Here we can see the dynamically learned MAC
addresses on VLAN 1 have climbed to 5,
950 and the total MAC address space available is down to 0.
Whether or not,
this greets the sniffing and eavesdropping opportunity our hacker wants
is again dependent on the age and type of switch,
but as a policy,
we do not want to allow our hacker access to the physical network and
certainly do not want our switch busy with this kind of effort.
Let me stop the attack and I'll show how port security will be configured
to deal with the MAC flood and the attacking system.
Returning to the switch command prompt,
I want you to see the default port security
configuration on the Cisco 3750 switch.
I'll use the show port-security interface f1/0/9.
This tells us that port security is disabled on interfaces by default.
The port status of secure-down does not mean much as
port security is not yet been enabled.
The default violation mode action is to the port.
We'll cover the aging timers later so I'll skip to the maximum
allowed default MAC addresses which is set to 1.
This is excellent at preventing multiple hosts from
sharing a switch interface through hubs,
switches, access points, or even as in the case here,
through virtual machines running on a host.
I will show you in a bit how to configure and allow more than
one MAC address should you have that need.
Currently,
there have been no statically configured or dynamically
learned secure MAC addresses for this interface as port
security has never been enabled.
To configure and start using port security is quite easy.
I'll move to global configuration mode, and to the interface,
FastEthernet 1/0/9 where I want port security.
To enable it, I will issue the switchport port-security command.
To examine the configuration, I'll use do show port-security interface f1/0/9.
Here we can see that it is indeed enabled and the port status shows secure-up.
At this point,
even though port security is enabled with a maximum of one MAC address,
there has not yet been any violation.
Port security is a passive filter which reacts to data entering the switchport.
A violation will not occur until an invalid MAC address appears on a
port configured for a different MAC address or the number of allowed
MAC addresses on a port has been exceeded.
At this point,
neither the Windows system nor the Ubuntu Linux system shows as having
been learned as a secure MAC address on that interface.
As the Windows system is pretty chatty,
my guess is it's probably already been learned on that interface.
Let's check again.
Here we can see that port security is still enabled,
the interface is still secure and up,
and now the last source address is consistent with
my Windows MAC address on VLAN 1.
The security violation count is still 0 because the
Ubuntu VM has not tried to send any data.
Now let's go back to the Ubuntu VM and start our attack to see what happens.
As soon as I send my attack, we can see that port security has disabled the port.
Here, we can even see the Ubuntu shows disconnected.
You're now offline.
This is because this switch has shut down that port.
I'm going to stop my attack and return to my switch interface.
Now let's take a look at the output in a little more detail.
Because of the MACOF attack,
a psecure or port security violation has occurred on
FastEthernet 1/0/9 and put the interface in err-disabled state
and taken that violation action of shutdown.
So now let's take a look at the configuration.
The port status shows secure shutdown and a last source address is
whatever the attacker sent in their MACOF packets.
Because of that default violation mode of shutdown,
it requires administrator intervention through the shutdown command and the no
shutdown command to recover from the port security violation.
Checking our configuration again,
we can see that the port status is now secure up,
but even if the Ubuntu VM tries to ping the default-gateway at 20.
1.
1,
it says the network is unreachable and that's because immediately port
security has already detected another violation,
and again, the port has been shut down.
If you look one more time at the port security configuration on the interface,
I want you to notice that the security violation counter is incremented
due to the detection of the added incorrect MAC address.
Since port security tests incoming traffic for the source MAC address
and validates devices based on that MAC address,
one of its flaws is MAC address spoofing.
If I return to my VM and I happen to already know the MAC
address of an allowed device on that interface,
I can manually set my card to use that MAC address through the
IP link command which sets my device ens33,
that's my network card, to use the MAC address,
in this case, of the Windows system.
Now that I've done that, I'm going to manually recover my switch interface.
Once I've recovered my interface and now that the Ubuntu system
is spoofing the Windows systems MAC address,
port security won't get tripped.
I'll return to my Ubuntu and I'll ping the default-gateway.
That looks like its working and I'll bring up my switch
prompt and there has been no violation.
Stop my ping, and now I'll try the MACOF attack.
As soon as I do that,
I've exceeded the maximum number of MAC addresses
associated with the port and we've been disconnected and
a security violation has occurred.
Stop my MACOF attack,
and we can see how port security has stopped the MAC flooding attack.
Now let's take a look at some of the options port security allows us.
The first thing I want to note is that we can change that
maximum number of secure MAC addresses above the default of
one by adding the maximum keyword.
This allows me to set a range from 1 to 6,
144 maximum MAC addresses that can be detected on that port.
In this case,
I'm going to set my maximum to 2 to allow for both the
Windows system and the Ubuntu VM.
Next, I can also change the violation reaction.
By default, again the violation standard is to shut the port down.
I also have the option of protect or restrict.
Protect will stop data from flowing through the port until the
violation condition has been corrected as we'll restrict,
but restrict will also add a security violation counter.
So in this case, I'm going to set it to restrict.
As we've seen, I have to manually recover that port,
which is great if I want administrators to be alerted
to problems within the network.
However,
this can create a lot of administrative overhead and a lot of tickets in a
dynamic variable environment where systems are changing ports.
In cases like this,
you may wish to automatically age out the MAC addresses and
allow for automatic recovery of the ports.
To allow port security to automatically age out
previously learned MAC addresses,
we'll use the switchport port-security command again,
instead this time, with the aging keyword.
We can age out statically configured MAC addresses
or the dynamically learned ones.
In this case, I'm only going to age out the dynamic ones,
but I'm going to add an aging time, which I can set anywhere from 1 to 1,
440 minutes.
I'm going to set the time to 1 minute and I'm also going to check out the type.
I have the option of absolute aging,
which will age out any dynamic addresses after 1 absolute minute or I can
choose inactivity to age out based on a lack of traffic.
In this case, I'm going to leave it the default, which is absolute.
Next, instead of dynamically learning MAC addresses,
I could use switchport port security to set a specific MAC
address statically on the interface.
If I do this, this will count towards my maximum number of allowed MAC addresses.
I can optionally also add on the sticky keyword.
Sticky MAC addresses are added to the running
configuration and are persistent through a reboot.
This can be a useful feature.
In this case, I'm not going to add a static MAC address.
One last feature to enable is automatic recovery after
the violation conditions have occurred.
To do that,
I'm going back to global configuration mode and I'll use the errdisable command.
This will allow any interface that's been put in the error
disable state due to port security to automatically recover
itself without an administrator intervention.
The command is errdisable recovery cause,
and in this case, the recovery cause will be due to psecure-violations.
Now let's look at my port security configuration.
Here we can see port security is enabled,
the port status is secure and up, the violation mode is restrict,
again,
that will restrict data from going through the interface until
the violation conditions have been corrected,
I've got 1 absolute minute of aging allowed for
dynamically learned secure MAC addresses,
and I've got a maximum MAC address count of 2,
and currently, 2 MAC addresses are associated with that interface.
So let's take a look at the MAC addresses on that interface.
Currently, the switches learn the MAC address of the Windows system,
as well as the VM on that interface,
but since port security allows only two maximum MAC
addresses associated with that port, the MACOF attack will fail.
In this case, the port security violation is a little bit different.
We see that there is a continual violation, but the port is not being shut down.
This is because the violation mode is set to restrict.
Once the MACOF attack stops, the port should automatically recover.
While the MACOF attack is running, let's show the port security configuration.
Notice the security violation counter is increasing every time MACOF
tries to exceed that maximum MAC addresses of 2.
If you have things like SNMP traps or intrusion detection systems,
they can key you into when an attack like this is happening.
Let's go ahead and stop our attack and return to our switch interface.
Once the violation conditions stop,
the security violation counters no longer increment and the
interface can be used for sending and receiving data.
In summary,
switch MAC table flooding attacks can create
eavesdropping and Denial of Service conditions.
Port security is an excellent countermeasure which can serve to
harden your network through authentication of devices to your
network based on their MAC address.
Those MAC addresses can be statically programmed or dynamically learned ones.
Port security can allow for a wide range of a maximum number of MAC addresses,
although the default behavior is to allow a maximum of one.
It alerts administrators to secure your risks and
other issues within the network,
especially if the violation requires manual recovery or
through logging in violation counter updates.
Be careful because port security can be
circumvented through MAC spoofing attacks,
it also does not stop attackers from connecting to your
network if you utilize the ability of port security to age
out previously learned MAC addresses.
Although port security cannot stop all attacks,
it's another excellent technique to add to your security
toolkit as part of a layered approach to stop ARP based and other types of attacks in your network.