STP Attacks

STP Attacks

1. What do attackers do? How do they do it?

   • Manipulate the Spanning Tree Protocol (STP)
   • By spoofing the root bridge and changing the topology of a network.
   • Attacker also can make
     • Hosts appear as root bridges
     • Capture all traffic for the immediate switched domain.

2. How to conduct an STP manipulation attack

   • The attacking host broadcasts STP (BPDUs) containing configuration and topology changes that will force spanning-tree recalculations
     • Then BPDUs sent by the attacking
       • Announce a lower bridge priority in an attempt to be elected as the root bridge
       • If successful
         • Attacking host becomes the root bridge
           • It will capture a variety of frames that would otherwise not be accessible.