0

I was reading how STP works and an idea came to my mind.

I thought about an attacker can add a new switch (somehow, i don't know if it can be done remotely) or can manipulate the existing switch's configuration. If the attacker sets the BID value to the lowest, that switch will be the root switch and the whole network will flow from that switch. Also it is possible that switch can learn the network if it is set to the dynamic desirable and it will be possible to learn the network via negotiation. I made some researches about that idea and I saw that there is really an attack like this called STP attack.

What I am wondering is, how this attack is proceed with wireshark or any other tools, what are the risks and how can the networking engineer prevent this? Which configuations are needed? Is it a good idea to disable negotiation and DTP and set the whole network manually?

Edit : I found a solution named Root Guard.

1 Answer 1

3

There are several ways to "attack" an STP network. You need to secure edge ports (or other untrusted ports) with options like

  • root-guard - prevents a port to become root port
  • bpdu-guard - disables a port on BPDU reception
  • bpdu-filter - ignores BPDUs received on a given port (disabling loop detection by STP!)
  • tcn-guard - ignores topology change notifications received on a given port

Note that even if you can make a switch root that is connected to the access layer, not much traffic flows through it. You'd have to position your switch between the core switches as well. Mostly, you'd only be disturbing proper traffic distribution.

Of course, how such "attacks" can be utilitized is off-topic here and cannot be discussed.

2
  • How do they (root and bpdu guards) work as a logic? Do they stable the root switch? If so how does it work? Mar 24, 2021 at 9:11
  • @RedAndBlack I've added some descriptions to my answer.
    – Zac67
    Mar 24, 2021 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.