U2.2 Switches, ARP

addressing
1. MAC
  1. media access control
  2. unique identifier for NICs
  3. source and destination in ethernet frames
  4. 48 bit value
2. IP
  1. 32 bits long
    1. 4 octects
  2. reserved ranges for private networks
    1. 10.0.0.0 - 10.255.255.255
    2. 172.16.0.0-172.31.255.255
    3. 192.168.0.0-192.168.255.255
  3. RFC 1918
ARP
1. address resolution protocol
  1. protocol that translates MAC addresses to IP addresses
2. steps
  1. 1. Device broadcasts to network: who has IP 192.168.0.x?
    1. ARP Query
  2. 2. All devices receive request and evaluate.
  3. 3. Device with 192.168.0.x responds with MAC address
    1. ARP Reply
  4. 4. Querying device updates its ARP table
switches
1. network topology like hub
2. only sends frames to intended recipient (rather than broadcasting like hub)
  1. generally more efficient than hubs because of this routing
3. maps ports to MAC addresses
4. layer 2
ARP spoofing
1. type of attack that uses ARP protocol to allow one network device to masquerade as another.
  1. ARP spoofing steps (see note)
    Anlagen:
    - U2.2 Switches, ARP - ARP spoofing steps
2. tools: DSniff http://www.monkey.org/~dugsong/dsniff/
3. defense
  1. statically define ARP cache
    1. big maintenance overhead
  2. lock down port-MAC mapping
    1. inflexible
  3. issue notification of port-MAC change
4. legitimate use: failover scenario, crashed server
MAC flooding attack
1. type of attack where the switch becomes overwhelmed and does one of 2 things
  1. switch does not accept any more mappings, freshly booted devices denied
  2. switch stops routing and broadcasts all messages
2. steps
  1. 1. Attacker floods network with gratuitous ARP replies with fake MAC addresses.
  2. 2. Switch attempts to map fake addresses and fills up its mapping table.
3. defense
  1. configure to ignore MAC address floods
    1. could deny legitimate traffic
  2. send admin alerts on MAC address floods

Nächster

U2.2 Switches, ARP

Beschreibung

Zusammenfassung der Ressource

ähnlicher Inhalt

	Erstellt von jjanesko vor mehr als 10 Jahre