Copy and Edit

U2.2 Switches, ARP

Description

Nework Security Mind Map on U2.2 Switches, ARP, created by jjanesko on 07/04/2014.
jjanesko
Mind Map by jjanesko, updated more than 1 year ago
jjanesko
Created by jjanesko about 10 years ago
31
0
0

Resource summary

U2.2 Switches, ARP
  1. addressing
    1. MAC
      1. media access control
        1. unique identifier for NICs
          1. source and destination in ethernet frames
            1. 48 bit value
            2. IP
              1. 32 bits long
                1. 4 octects
                2. reserved ranges for private networks
                  1. 10.0.0.0 - 10.255.255.255
                    1. 172.16.0.0-172.31.255.255
                      1. 192.168.0.0-192.168.255.255
                      2. RFC 1918
                    2. ARP
                      1. address resolution protocol
                        1. protocol that translates MAC addresses to IP addresses
                        2. steps
                          1. 1. Device broadcasts to network: who has IP 192.168.0.x?
                            1. ARP Query
                            2. 2. All devices receive request and evaluate.
                              1. 3. Device with 192.168.0.x responds with MAC address
                                1. ARP Reply
                                2. 4. Querying device updates its ARP table
                              2. switches
                                1. network topology like hub
                                  1. only sends frames to intended recipient (rather than broadcasting like hub)
                                    1. generally more efficient than hubs because of this routing
                                    2. maps ports to MAC addresses
                                      1. layer 2
                                      2. ARP spoofing
                                        1. type of attack that uses ARP protocol to allow one network device to masquerade as another.
                                          1. ARP spoofing steps (see note)

                                            Attachments:

                                          2. tools: DSniff http://www.monkey.org/~dugsong/dsniff/
                                            1. defense
                                              1. statically define ARP cache
                                                1. big maintenance overhead
                                                2. lock down port-MAC mapping
                                                  1. inflexible
                                                  2. issue notification of port-MAC change
                                                  3. legitimate use: failover scenario, crashed server
                                                  4. MAC flooding attack
                                                    1. type of attack where the switch becomes overwhelmed and does one of 2 things
                                                      1. switch does not accept any more mappings, freshly booted devices denied
                                                        1. switch stops routing and broadcasts all messages
                                                        2. steps
                                                          1. 1. Attacker floods network with gratuitous ARP replies with fake MAC addresses.
                                                            1. 2. Switch attempts to map fake addresses and fills up its mapping table.
                                                            2. defense
                                                              1. configure to ignore MAC address floods
                                                                1. could deny legitimate traffic
                                                                2. send admin alerts on MAC address floods
                                                              Show full summary Hide full summary

                                                              Want to create your own Mind Maps for free with GoConqr? Learn more.

                                                              Similar

                                                              U2.6 SNMPv3
                                                              jjanesko
                                                              U2.1 Cables, Hubs, Sniffers
                                                              jjanesko
                                                              U2.4 LANs, MANs, WANs
                                                              jjanesko
                                                              U2.5 SNMPv1
                                                              jjanesko
                                                              U2.1 Cables,Hubs,Sniffers- Thin Ethernet
                                                              jjanesko
                                                              U2.5 SNMPv1 - architectural model
                                                              jjanesko
                                                              U2.1 Cables, Hubs, Sniffers - Hub Diagram
                                                              jjanesko
                                                              U2.2 Switches, ARP - ARP spoofing steps
                                                              jjanesko
                                                              U2.3 TCP, Routers - Router Diagram
                                                              jjanesko
                                                              U2.5 SNMPv1 - SNMPv1 protocol stack
                                                              jjanesko
                                                              U2.3 TCP, Routers, VLAN
                                                              jjanesko
                                                              Browse Library