About this interactive
Every Layer 2 hardening feature on a Cisco switch was invented in response to a specific attack, and the fastest way to remember the feature set is to remember what each one was built to stop. That is the whole design of this matcher: nine attacks, nine countermeasures, one pairing each. MAC address flooding pairs with port security. The attack fills the MAC address table with forged source addresses until the switch has nowhere left to record real ones and begins flooding every unknown frame out every port, turning it into a hub an attacker can sniff. Port security ends the attack at its input by limiting how many MAC addresses a single port may learn; the violation modes (protect, restrict, shutdown) differ only in how loudly the switch reacts. DHCP starvation pairs with DHCP snooping. An attacker leases every address in the pool by flooding requests with spoofed client identifiers, and legitimate hosts then get nothing. DHCP snooping rate-limits DHCP messages on untrusted ports, which is what stops starvation, and it also drops server replies arriving from untrusted ports, which is what stops the rogue-server half of the DHCP attack family. Note the side effect that matters more than the feature itself: snooping builds a binding table of valid IP-to-MAC-to-port mappings. ARP spoofing pairs with Dynamic ARP Inspection, and IP address spoofing pairs with IP Source Guard, and both of those features read that same binding table. This is the one structural insight worth carrying out of the module. DAI validates the IP-to-MAC claim inside an ARP message; IP Source Guard validates the source address of ordinary data frames. Neither can work until DHCP snooping is enabled first, because neither has any notion of a legitimate mapping without it. If a lab shows DAI dropping everything, the usual cause is not DAI. VLAN hopping appears twice, deliberately, because the two variants have completely different fixes and the exam separates them. Switch spoofing is the attacker's host pretending to be a switch: it sends DTP frames, the port negotiates a trunk, and the attacker now receives traffic from every VLAN. The fix is to stop negotiating at all, which means switchport mode access and switchport nonegotiate on every user-facing port. Double-tagging is a different trick, and it does not need a trunk. The attacker sends a frame carrying two 802.1Q tags; the first switch strips the outer tag because it matches the native VLAN, and forwards the frame with the inner tag still attached, which the second switch obeys. The fix is not about DTP at all - it is to make the native VLAN an unused VLAN with no hosts in it, so no attacker sits in the VLAN the outer tag has to match. Read the mitigation and you can name the variant. STP root bridge takeover pairs with BPDU Guard. A rogue switch advertising a very low bridge priority wins the root election, and the resulting topology recalculation drags traffic through the attacker's device. BPDU Guard is deliberately blunt: an access port configured with PortFast should never see a BPDU, so receiving one puts the port straight into err-disabled state. That bluntness is the point, and it is also the reason it belongs on edge ports rather than uplinks. An unauthorized device on an access port pairs with 802.1X. Port security keys on MAC address, which an attacker can copy from any label or sticky-learned entry; 802.1X keys on an identity proven to a RADIUS server, and holds the port closed to everything but authentication traffic until that happens. The distinction between the two is a common exam target: port security counts devices, 802.1X authenticates them. CDP and LLDP reconnaissance pairs with disabling those protocols on untrusted ports. Nothing is exploited here - the switch simply announces its model, software version, native VLAN, and port identity to anything that plugs in, and that is a reconnaissance gift that shortens the attacker's path to a working exploit. CDP is Cisco proprietary and on by default, which is why it is the one to remember. Two habits will serve you past this activity. First, when you meet a new Layer 2 feature, ask which attack it was written for; the answer is almost always a single specific one, and the pair is far easier to hold than either half alone. Second, when you build a real access-port template, apply these in dependency order - DHCP snooping first, then DAI and IP Source Guard on top of it, then port security, BPDU Guard, and 802.1X, which stand on their own.
About TechKnowSurge
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →