which method would mitigate a mac address flooding attack

GNS3 – Open source network emulator VMware Workstation ConfigurationĪ host-only virtual network adapter and assign it to each VM in the lab. Ubuntu Desktop 19.10 VM – Our DHCP clientĬisco IOSvL2 15.2 – The image for the switch Ubuntu Server 19.10 VM – The DHCP server we The following tools were used to build this lab: Introduces a rogue DHCP server onto our LAN. Life is good until an attacker plugs into our switch and And an Ubuntu workstation acting as our DHCP client. In this lab topology, we have an Ubuntu Server acting as To other switch security features such as Dynamic Arp Inspection and IP SourceĪnyways, let’s see all this in action in our lab. Great resource for troubleshooting a problem. VLAN and switchport number the addresses are tied to. Inside this database we see client MAC addresses Onto an untrusted port are automatically disregarded.ĭHCP snooping also keeps track of DHCP bindings and Whereas,Īll other ports are considered untrusted. That are connected to legitimate DHCP servers are labeled as trusted. When we enable DHCP snooping on our trusty Cisco switchĪll ports are now categorized as either trusted or untrusted. One way this type of attack is mitigated this is through aĬisco Catalyst switch feature called DHCP snooping. Will be forwarded to the rogue server first before being sent to its actualĭestination. It puts its own IP address as the default gateway. This rogue device starts handing out IP leases, however, We might not think of the possible security implications.Ĭonsider this, an attacker introduces a rogue DHCP server That is why we set up a DHCP server and then kick back and allow it toĪutomatically assign IP addresses to each client on our LAN.

The network/system administrator to statically configure IP addresses to eachĬlient. Subnet mask, default gateway, DNS, etc…).įor medium, to large enterprises, it’s impractical for Is for eachĭevice needing to be configured with basic addressing info (i.e.

Network to communicate with each other and out to the internet. One of the basic requirements, for local clients on a

Then examine how it could have been mitigated through the In the following article, we will first pull off a DHCP 6 Remediation with DHCP Snooping Introduction

Which method would mitigate a mac address flooding attack