This feature usually relies on the "port security" feature to retain all secure MAC addresses for at least as long as they remain in the ARP table of layer 3 devices. Additional security measures are sometimes applied along with the above to prevent normal unicast flooding for unknown MAC addresses.Security features to prevent ARP spoofing or IP address spoofing in some cases may also perform additional MAC address filtering on unicast packets, however this is an implementation-dependent side-effect.Implementations of IEEE 802.1X suites often allow packet filtering rules to be installed explicitly by an AAA server based on dynamically learned information about clients, including the MAC address.Many vendors allow discovered MAC addresses to be authenticated against an authentication, authorization and accounting (AAA) server and subsequently filtered.A smaller table of secure MAC addresses is maintained in addition to (and as a subset to) the traditional MAC address table. With a feature often called "port security" by vendors, many advanced switches can be configured to limit the number of MAC addresses that can be learned on ports connected to end stations.To prevent MAC flooding attacks, network operators usually rely on the presence of one or more features in their network equipment:
MAC flooding can also be used as a rudimentary VLAN hopping attack. The attacker may also follow up with an ARP spoofing attack which will allow them to retain access to privileged data after switches recover from the initial MAC flooding attack. It is from this flooding behavior that the MAC flooding attack gets its name.Īfter launching a successful MAC flooding attack, a malicious user can use a packet analyzer to capture sensitive data being transmitted between other computers, which would not be accessible were the switch operating normally. The effect of this attack may vary across implementations, however the desired effect (by the attacker) is to force legitimate MAC addresses out of the MAC address table, causing significant quantities of incoming frames to be flooded out on all ports.
The intention is to consume the limited memory set aside in the switch to store the MAC address table. In a typical MAC flooding attack, a switch is fed many Ethernet frames, each containing different source MAC addresses, by the attacker. The advantage of this method is that data is bridged exclusively to the network segment containing the computer that the data is specifically destined for.
This allows the switch to direct data out of the physical port where the recipient is located, as opposed to indiscriminately broadcasting the data out of all ports as an Ethernet hub does. Switches maintain a MAC table that maps individual MAC addresses on the network to the physical ports on the switch. The attack works by forcing legitimate MAC table contents out of the switch and forcing a unicast flooding behavior potentially sending sensitive information to portions of the network where it is not normally intended to go. In computer networking, a media access control attack or MAC flooding is a technique employed to compromise the security of network switches. Technique employed to compromise the security of network switches
0 kommentar(er)
