TechKnowSurge
Cisco CCNA 3.4 Cisco CCNA 5.1
TechKnowSurge Catalog Videos DEMO: Configuring Passive Interfaces
VideoNetworkFree

DEMO: Configuring Passive Interfaces

OSPF passive interfaces prevent hello packets from being transmitted on network segments where routing updates are unnecessary, reducing resource consumption and eliminating a significant attack surface.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

OSPF relies on hello packets sent to the multicast address 224.0.0.5 to discover and maintain neighbor relationships, but the network statement used during configuration often matches interfaces where no OSPF neighbors should ever exist, such as internal VLAN interfaces on a Layer 3 switch. On those segments, every connected end device receives and processes multicast OSPF traffic before discarding it, consuming a small but unnecessary amount of resources across every host on the subnet. The more serious concern is the security exposure this creates. An attacker monitoring the network with a packet capture tool can identify that OSPF is running, read the hello packet fields to learn router priorities, hello intervals, and dead intervals, and begin mapping the network topology. From there, the attacker can inject false routing information into the OSPF area, redirecting traffic through a rogue device to enable a man-in-the-middle attack or causing a denial-of-service condition by sending traffic to unreachable destinations. The passive-interface command eliminates this risk by stopping OSPF hello transmissions on a specified interface without removing that network from OSPF routing updates. The router continues to advertise the connected network to its legitimate OSPF neighbors, but no hello packets are sent into the local segment. Applying this command under the OSPF process configuration takes effect immediately and can be verified by confirming that OSPF multicast traffic no longer appears on the interface. To restore normal OSPF behavior on a passive interface, the command is simply prefixed with no.

What you'll learn

What's covered

OSPF Passive Interface

Aligned to

Cisco CCNA
3.4 Configure and verify single area OSPFv2
5.1 Define key security concepts

Key terms

Open Shortest Path First
OSPF
A link-state interior gateway routing protocol that maintains a complete map of the network topology and uses Dijkstra's Shortest Path First algorithm to calculate optimal, loop-free routes. OSPF divides networks into hierarchical areas to improve scalability and supports VLSM and rapid convergence.
Routing Protocol
A protocol used by routers to communicate and share routing information to determine the best path for data.
Passive Interface
A router or switch interface configured to suppress the transmission of OSPF Hello packets, preventing neighbor formation while still advertising the connected network.
Hello Packet
An OSPF control message sent periodically on active interfaces to discover neighbors, verify reachability, and maintain adjacencies.
Attack Surface
The total set of points in a system where an unauthorized user can attempt to enter or extract data.
Man-in-the-Middle Attack
MitM
An attack where an adversary secretly intercepts and potentially alters communications between two parties.

Transcript

We've been talking a lot about these OSPF packets and how they get sent out on these interfaces. The problem with that is it does eat up some resources, and even more importantly, can present a bit of a security risk. So let's talk about how we can make an interface passive and not have these.

Why Passive Interfaces

When we set up OSPF on our networks, we use this network statement of 10.0.0.0, and slash eight essentially is what that is. What that does is it specifies both what networks are going to be sent out with its updates, but also which interfaces that's going to be sent out on. That becomes a little problematic.

This layer 3 switch right here, we want these networks that are connected to it, all of these VLANs, we want that to be sent out and broadcasted out to the rest of the network, so the rest of the network knows how to get to these VLANs. The problem is, once again, that presents a little bit of a — well, number one, it uses up some resources, because it's sending out into that network and then all of these devices are listening to that. And the second problem is that it presents a little bit of a security risk.

Seeing the Risk in Wireshark

Let me just show you what I mean here. I'm going to pull up Wireshark here, and I'm going to set up ethernet. So I'm going to click on the ethernet connection right here, and as we go through here we see some spanning tree messages, and here we see an OSPF message right here. Notice it's a multicast address, 224.0.0.5. So what's going to happen is it's getting to this computer, and this computer says, ah, I don't need that, and gets rid of it. So it's eating up resources of this computer. Not a lot, but it is a little bit.

The second problem with this is it's also a piece of information that I can get. I know OSPF is running. I could set up OSPF and start leveraging this for something that I want to do to the network, like gather information and figure out — there's a lot of information in OSPF, so I can start figuring out what the network looks like and start attacking individual pieces of equipment that's out there.

Or another thing I could do is I could just start participating. I can actually say, hey, I want to be a part of this OSPF area, and I then can insert bad information in there, and then traffic's going to start coming to me. Or it's a denial of service attack, so either the traffic's not getting to where it's supposed to go, or it's being routed through me and I've got this man-in-the-middle attack. So I can use this to the advantage.

Inspecting the OSPF Packet

Since we've got this open, I might as well just open up and take a look at this. Open shortest path first — we see the OSPF header like we were talking about, so that's pretty cool. We see the hello packet in here, and so we can see some different information inside of the hello packet, the things that we had already discussed, such as the router priority, the router dead interval, and the hello interval. So we see those pieces of information in there.

Configuring the Passive Interface

Anyways, we don't want this. We don't want this to be sent out on our network, and it's a pretty simple command to stop this from happening. So what I'm going to do is pull up that switch. This is part of VLAN 10. So I'm going to get into VLAN 10. I'm going to go into the global configuration mode, and then interface VLAN — or, excuse me, I actually am going to do a router ospf and our process ID of 10. Then I'm going to give the command passive-interface VLAN 10, and we're going to hit enter there.

So now what we're going to do is look to see if we're still going to get those OSPF messages. The last message I got is right here, and it should come in every 10 seconds. So all I need to wait is 10 seconds to see if it gets any more. So far we're good. So now this simple command has cleared it up, where I'm not getting those hello messages, those OSPF messages, into the network. We've waited at least a good 10 seconds now, and we don't see that. So wherever you have it, that's how we do it.

If I want to undo this command, I would just go in here and put no at the front of it, and as soon as we do that, we should start seeing the OSPF messages pop up in here again. And there it is.

So that is a command that you'll want to put in on your network, so that way you're not sending out this traffic into your VLANs and into your networks.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →