Network Attacks

There are several network attacks that can be done to attack one's network. A few of them are MAC address flooding attack, VLAN Hopping and Switch Spoofing.

MAC address flooding attack sends out numerous frames to the switch using different source MAC addresses. This will load the switch with processing capacity since it needs to find maintain those MAC addresses in the switching table. It will also create a denial of service (DoS), because when the memory for the MAC address table is run out, legitimate hosts will not be able to access the switch. Unnecessary bandwidth consumption is also being used since MAC address flooding will flood the network with broadcasts. From this attack, the attacker can also intercept packets with a packet sniffer, since this client can receive broadcasts from legitimate hosts. To prevent this, illegitimate hosts should be kept out of the network and should be blocked if they want to access the network. Port-based authentication and port security can be implemented to implement this prevention.

VLAN Hopping uses double VLANs to spoof the switch by using double VLANs. In order to do this, the host should be able to access the port, be placed in the native VLAN, and the switch should use dot1q. The attacker will use 2 different VLANs, where one is the native VLAN. When the switch sees a frame from a native VLAN, it will remove the VLAN tag and sends it in the network untagged (dot1q protocol). What the switch does not know is that the frame has a second VLAN tag. At this moment, the attacker's frame is free to attack other hosts for phising, trojan, virus etc using their second VLAN to attack users having the same VLAN as the second VLAN of the attacker. To prevent this, simply create a native VLAN where there are no host attached to it. In this way, every frame from the host is being inspected.

Switch spoofing uses the behavior of switches running a port in dynamic desirable mode. In this way, a switch will aggressively try to form a trunk port with its peer, without knowing who or what its peer is. The attacker can spoof the switch by acting as a switch and accepting the trunk. From this moment on, the attacker has the ability to listen traffic running through its device and can find out user names, passwords, credit card numbers etc. To prevent this, the switch should only set dynamic desirable mode or auto mode to ports that are known to have trusted switches at its peer. All other ports should be set to access mode.

Private VLAN

A private VLAN is used to restrict a client so that it can only access a specific port or limited users. Each port can be configured in 3 ways:

1. Promiscuous mode where the client attached to that port can access primary and secondary VLAN clients. Usually, this mode is applied to gateway devices such as routers

2. Isolated mode where the client can only communicate with the primary VLAN and with devices in promiscuous ports., but not to the host in the same secondary VLAN (Same VLAN) or different secondary VLAN (different VLAN). Basically the client can communicate only a one-on-one relationship with the gateway.

3. Community mode where the client can communicate only with other host in the same secondary VLAN, and with devices in promiscuous ports, but not to other host in secondary VLAN (different VLAN)


The configuration of the private VLAN is shown below:

(config)#vlan
(config-vlan)#private-vlan community // it can also be set as isolated or primary
Private VLAN need to be set only on VTP transparent mode*. Then the private VLAN needs to be associated to a primary VLAN.
(config-vlan)#private association // note that the primary vlan needs to be created first, it will not create it automatically

Then the port needs to be set in private mode:
(config)#interface fast // the port that we want to set
(config)#switchport mode access // make it an access port first
(config)#switchport mode private-vlan // host is used when we want to define the port attached to the client, promiscuous is used when we want to define the port attached to the gateway device.

VLANs: creating, trunking and dynamic assignments

VLAN stands for Virtual LANs. It is used to create LANs that seems to be virtually separated although they are actually in the same physical network. One of the reasons for creating VLANs is to disconnect a network let’s say the IT security network from the Administration network in an office virtually.

Take for example a network with PC1 to PC10. Two VLANs are created which are VLAN A (PC1 – PC5) and VLAN B (PC6 to PC10). When a VLAN is created in the network, the broadcasts that were initially sent to all users will be restricted to the users in the same VLAN only. This can be done because the frame is tagged with a VLAN ID when it sends its data to the switch so that the switch knows where to send to. For this example, broadcasts that were initially sent to PC 1 to PC 10 when there were no VLANs will change. Only PC 1 to PC 5 will get the broadcast if it happens from VLAN A. Also, when VLANs are applied PC1 could even not ping to PC 6 – PC 10 because they are in a different network. Cisco’s best practice is to have 1 VLAN per subnet.

To show the VLANs and existing ports on it, the command “show vlan brief” can be used on the switch’s CLI. If the port that is supposed to be there does not exists in the "show vlan brief" command, then it means that the port is in the trunking command. To make sure of this, type the “show vlan trunk” command. To create a VLAN (e.g VLAN 20) just type the command VLAN 20 in the switch’s configuration mode. To insert an interface to a VLAN (assume to VLAN 20) go to the interface mode and type the “switchport access vlan 20” command.

A trunk can be created to make the VLANs across local LANs. However, a trunk belongs to all VLANs. To create a trunk, put the command “switchport mode trunk” in the interface mode of the desired interface on the switch to be the trunk. If the pairing switch is set at dynamic, then the pair switch will automatically make its port connecting to the originating switch as a trunk as well.

All the VLAN configuration above is done with “static” VLAN. There is also a possibility to create a dynamic VLAN which can detect automatically the MAC address of the device and puts them in the same VLAN although it has changed its port. This is done with a VMPS (VLAN Membership Policy Server). It can do this dynamic assignment by using a TFTP server that has a database that can store information about the mapping of VLANs and their MAC addresses associated to it. This database is downloaded every time the power cycle is done. The port on the switch that receives a dynamic VLAN assignment will turn its port to Portfast automatically. VMPS itself uses UDP data to listen to its clients requests.

So, to summarize, vlans are created to separate networks on a same physical network. It can also be done to create a LAN although it is physically separated, but remember to put a trunk port in the switches before. Besides static VLAN configuration, there is also dynamic VLANs which uses the VMPS.