Port Security

Port security is a set of commands we can put on our ports in order to manage the traffic on those ports. It mitigates against a lot of different types of attacks, so we're just going to talk about two of the attacks that it will mitigate against.

I'm going to have these attack note cards. The attack note cards are to break down each of these attacks into some just very simplistic explanation of the different attacks. It's going to have the attack name, a brief explanation of what it is, it's going to explain how it works, it's going to talk about some different tools — that is, some different programs that you can use to actually carry out the attack — and then how we're going to mitigate against those attacks.

MAC Address Flooding

The first attack that we'll go over is MAC address flooding. An attacker is going to try to turn a switch into a hub. That is, the attacker is going to try to make the switch flood out packets out of all of its ports, and then the attacker can read all of the traffic that's coming across that switch.

One of the great things about switches is that they're much more secure than a hub. When we had hubs on our network, any frames that came into that hub would get forwarded out all other ports — to include, if somebody was listening in, they would be able to see all of the traffic that goes across that hub. When we switched to switches, we then make our network more secure. So when the demo laptop sends out a frame, this switch records the MAC address and the port that it comes in on, and now if anything's going to that MAC address, it can send it only on to this demo laptop and not out all of its ports.

Now an attacker will leverage this. What an attacker will do is it will send out a lot of different frames with different MAC addresses, and it will fill up this MAC address table. Once the MAC address table fills up, then this switch essentially becomes a hub. And since this will get propagated to the rest of the network, all of these switches will eventually become hubs, and then this attacker will get to see all of this traffic that's coming across the network.

One of the tools that they'll use to do this is the macof tool, but there's a lot of other different tools as well. One of the ways we can mitigate against this is port security, which limits the number of MAC addresses that you can have on any one of your ports.

DHCP Starvation

The next attack that we'll talk about is DHCP starvation. DHCP starvation is when an attacker attempts to take all of the IP addresses that are available on a network, so then no one else can get an IP address. This is a type of denial of service attack — the type of denial of service attack that now devices on the network can't get IP addresses and can't communicate out on the network.

What an attacker will do is make a lot of requests on the network for IP addresses. It'll send out multiple requests until the DHCP server — whatever device is running your DHCP services on — will run out of IP addresses to hand out. Now whenever a new client connects to your network, it won't be able to get an IP address, so it won't be able to get onto the network.

One of the tools that can help carry out this attack is DHCP starve. However, a simple way to mitigate against this attack is using port security. That way no one port can take up all of the IP addresses, because it can only send out a certain amount of MAC addresses on that network.

Port Security

Port security is something we can turn on on every single port that we want to protect, and what it does is it can limit the number of MAC addresses on the port, or it can limit which MAC addresses are allowed on that port. So there's a few different things that we can do with it, but essentially what it does is it limits the number of machines that can be on the other side of that port, so the attacker can't mimic a lot of different machines. It has the added advantage to make sure that when you're on your network, somebody doesn't come and plug in switches and other devices on your network that's not supposed to be on your network — and I've used it for that as well.

There are a number of settings that we're going to be configuring on each one of our ports. The first one is just setting the maximum number of MAC addresses: do we just want one or two MAC addresses that are available on that port, do we want 5, 10 — how many are we going to allow on that port? The next thing is, how is it going to learn those MAC addresses? We can manually configure MAC addresses on there, or we can dynamically learn those MAC addresses, or this sticky function means that it'll dynamically learn but then it can save that configuration. The next is the age of the MAC address: how long do we want those MAC addresses to stay on that port? And then finally, what happens to that port if the number of MAC addresses goes above the allotted MAC addresses?

Learning MAC Addresses

The three ways of learning those MAC addresses are: manually, being able to go in there and type out the MAC address, and then those are the MAC addresses that are allowed on the port; or it can learn it dynamically, and if it learns it dynamically then it just keeps track of what is connected to that port; and then you can have this sticky, which means that it learns it dynamically but then it enters the MAC address into the configuration, so that way if you do a restart on that device it still stays in there. So that is dynamically learning, but it saves it to the configuration.

There are times when we have set maybe five MAC addresses that can be on that port, and let's say we set two of them to be manually — so those two MAC addresses are going to be allowed to access that port, and then those extra three will be dynamic at that point in time. So you can actually mix and match these as well.

Aging

Another thing that we can set up on those ports is aging of these MAC addresses. Do we want it to be able to have those MAC addresses and then it stays that way for eternity? More than likely, a lot of times what we want to do is we want to have those MAC addresses age out, so that way when something gets unplugged, over time that MAC address gets cleared from the configuration and another device can come in and plug in, so that way now the new devices can get onto that port. So how long are those MAC addresses going to last on there?

There's a couple different types that we can set up. The time just allows us to set the time — that's the time feature. There's a type on there, whether we want absolute or inactive. What that means is, let's say we set the time to be — how about we set it to be 30 minutes, and so that's the 30 minute timer that happens. Does that timer happen from the time that you plug in that device and then 30 minutes later it ages out, or the time that it's inactive? So let's say that device is on for 15 minutes, and then at the 15 minute mark then it starts the timer, the 30 minute timer, and then ages out after that. And then finally, whether you want it to affect the static or the manually entered addresses on that machine.

Violation Modes

Then on these ports we can set what happens when things are violated. So if we've set up on a specific port that it can have five MAC addresses on that port, then what happens to it if it goes above five MAC addresses? One thing we could do is we could shut down the port, or we could restrict the port, or we could protect the port.

If we shut down the port, what will happen is as soon as you get that sixth MAC address on that port, the port will go into err-disabled and none of those MAC addresses will be able to communicate. No device on that port will be able to communicate. In fact, it won't be able to communicate until someone gets onto that switch, onto that port, and does a shutdown, no shutdown, so then that brings that port back live again.

Then we have the restrict. The restrict means that all packets are going to get dropped on that port, but what happens is as soon as it gets back into the five range and there's only five MAC addresses on that port, then it will start operating again. So there's a faster recovery with this, because as soon as you get back into the realm of what you're supposed to be at, now all those devices can communicate again.

The protect is the least restrictive. The protect means that you can have those first five MAC addresses that started communicating still communicate, but anything above and beyond is not going to be allowed to communicate on that port. All other MAC addresses that join that port are going to get dropped. What will happen is, let's say you have six or seven MAC addresses that are trying to communicate — those top two are not going to be able to until one of those other spots clears up, until they age out, and then they will be able to communicate again.

Now with these, the counter gets incremented. There's an error counter on here that gets incremented up on the shutdown and restrict, and sends something to the syslog server, versus the protect is not going to do that. So that's the violation states that we have that we can select on each one of these ports.

Recap

We talked about MAC address flooding, which is when an attacker fills up the MAC address table of a switch, turning it into a hub so it can see all the traffic across that switch. Then we talked about DHCP starvation, which is when an attacker tries to grab all of the available IP addresses in DHCP so no other devices can get onto the network — a type of denial of service attack. And then we got into port security and how we can limit those two attacks.