2

There's nothing written about it on the internet. Nothing about if it's currently possible to carry out, or how to counter it. Just this definition copy pasta everywhere:

STP (Spanning-Tree Protocol) mangling refers to the technique used for the attacker host to be elected as the new root bridge of the spanning tree. The attacker may start either by forging BPDUs (Bridge Protocol Data Units) with high priority assuming to be the new root, or by broadcasting STP Configuration/Topology Change Acknowledgement BPDUs to get his host elected as the new root bridge. By taking over the root bridge, the attacker will be able to intercept most of the traffic.

Also another question, what's a Configuration/Topology Change Acknowledgement BPDU?

1

Switches send out BPDUs (Bridge Protocol Data Units) to elect a root bridge. Initially, every switch assumes it is the root bridge,until it receives a superior BPDU. This is an ongoing process. Also, when a switch notices a change in the topology (link up/down), it will send TCN (Topology Change Notification) BPDUs.

If you haven't correctly configured, or your switches don't support, the available STP security/stability measures (e.g. root guard), an attacker could send out BPDUs in order to take over from the root bridge. STP creates a loop-free environment by having the switches send traffic toward the root bridge. An attacker could have traffic sent toward it.

| improve this answer | |
  • So all switches have root guard by default? – User104163 Apr 18 '16 at 18:12
  • No, not at all. Cisco has root guard, and other STP security/stability protocols, but not all vendors have anything likes this, although most enterprise-grade vendors have these types of things. – Ron Maupin Apr 18 '16 at 18:21
  • Oh. Do 3com 4400 and 4900 switches have them? – User104163 Apr 18 '16 at 18:31
  • I don't specifically know about those switches. – Ron Maupin Apr 18 '16 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.