-
Ethernet Switching Concepts:
-
MAC Flooding:
- The behavior of switches as they receive frames whose destination MAC addresses are broadcasts, multicasts, or unknown unicasts.
- The switch responds by performing best-effort forwarding, copying the frame and sending it out of all available switch ports.
-
CAM Table:
- Content-Addressable Memory. The location in memory used to store and quickly retrieve MAC addresses.
-
Layer 2 vs Layer 3
-
Layer 2 Switch:
- Traditional switching operates at layer 2 of the OSI model, where packets are sent to a specific switch port based on destination MAC addresses.
-
Layer 3 Switch (MLS):
- A Layer 3 switch is basically a switch that can perform routing functions in addition to switching.
- Routing operates at layer 3, where packets are sent to a specific next-hop IP address, based on the local device's routing information regarding the received destination IP address.
- Devices in the same layer 2 segment do not need routing to reach local peers, but do need the destination MAC address, which can be resolved through the Address Resolution Protocol (ARP).
-
Port Security
- A Layer 2 traffic control feature on Cisco Catalyst switches.
- Individual switch ports allow only a specified number of source MAC addresses
-
Loop Prevention
-
Spanning Tree Protocol (STP):
- A Layer 2 protocol designed to prevent bridging loops and allow redundant Layer 2 network design.
-
Flood Guard:
- A protection feature that allows the administrator to configure rate limiting for processes consuming large bandwidth share.
-
List the four possible failure modes for a security device:
-
Fail Closed:
- When the device detects failure conditions, it shuts down and prevents further operation.
- An example of a fail closed security device is a firewall.
- This strategy is common in situations where security is prioritized above access.
-
Fail Open:
- When the device detects failure conditions, it remains open and operations continue as if the system were not in place.
- An example of a fail open security device is an Advanced Malware Protection Sandbox, or a Layer 2 Switch.
- This strategy is used when access is more important than security.
-
Fail Safe:
- When the device detects failure, its configuration mitigates harm from coming to other system components.
- An example of a fail safe security device is a bypass switch
-
Fail Over:
- If the primary device fails, functionality is not lost, because redundancy exists in the network.
- For the duration of the fail over, the secondary device acts as the primary.
-
Potential LAN Threat Vectors:
-
MAC Spoofing:
- The attacker changes or masks the Layer 2 MAC address of a NIC on a networked device with a false MAC address.
-
ARP Spoofing:
- The attacker impersonates the destination of the target's traffic.
- To prevent this attack, use Dynamic ARP Inspection, lower the ARP aging timer, and configure DHCP snooping.
-
DHCP Starvation (Exhaustion) Attack:
- An attacker broadcasts DHCP requests with spoofed MAC addresses.
- To prevent this, enable DHCP snooping to deny DHCP Offers and Acknowledgements from untrusted ports.