CCNA 2 - Capitulo 10.3

CCNA 2 - Capitulo 10.3

1. LAN SECURITY CONCEPTS

   • LAYER 2 SECURITY THEATS
     • SWITCH ATTACK CATEGORIES - ATTACKS
       • ARP ATTACKS
         • ARP SPOOFING
           • GRATUITUS ARP
             • WHATS PROBLEM THIS ?
               • GRATUITOUS MESSAGE CONTAINING A A SPOOFED MACA AND THE SWITCH UPDATE THIS MAC ACCORDINGLY
             • WHEN A HOST SENDS A GRUITOUS ARP , OTHER HOSTS ON THE SUBNET STORE THE MAC AND IPV4 IN THEIR ARP TABLES
           • HOW DOES THE ATTACK WORK?
             • THREAT ACTOR SEND UNSOLCITED ARP REPLIES TO OTHER HOSTS WITH MAC ADDRESS OF THE THREAT ACTOR AND THE IPV4 THE DEFAULT GATEWAY
           • WHAT TOOLS WERE USED?
             • ETTERCAP
             • YERSINIA
           • (RFC 826)
         • ARP POISONING
           • RESULTED OF THE ARP SPOOFING
         • MITIGATION TECHNIQUES ?
           • DYNAMIC ARP INSPECTION (DAI)
     • SWITCH ATTACK CATEGORIES - ATTACKS
       • SPOOFING ATTACKS
         • MITIGATION TECHNIQUES ?
           • IP SOURCE GUARD (IPSG)
         • MAC ADDRESS SPOOGING
           • HOW DOES THE ATTACK WORK?
             • MATCH ANOTHER
               • MAC ADDRESS OF A TARGET HOST
             • 1. A THREAT ACTOR ALTERS THEIR MAC ADDRESS TO MATCH TARGET HOST
             • 2. SWITCH RECEIVES THE FRAME, LEARNS THE SPOOFED SOURCE MAC, AND UPDATES THE MAC TABLE WITH THE NEW ENTRY.
             • 3.THE LEGITIMATE HOST SENDS TRAFFIC, THE SWITCH DETECTS THE CHANGE AND REALIGNS THE MAC ADDRESS TO THE CORRECT PORT.
             • 4.THREAT ACTOR CAN CREATE A PROGRAM OR SCRIPT THAT WILL CONSTATLY SEND FRAMES TO THE SWITCH MANTAINS INCORRET OR SPOOFED INFORMATION
         • IP ADDRESS SPOOGING
           • IS WHEN A THREAT ACTOR HIJACKS A VALID IP ADDRESS OF THE ANOTHER DEVICE
           • DIFICULT TO MIGATE , ESPECIALLY USED INSED A SUBNET
       • SPANNING TREE PROTOCOL (STP ATTACKS)
         • MITIGATION TECHNIQUES ?
           • BPDU GUARD
         • HOW DOES THE ATTACK WORK?
           • ATTACKING HOST ANNOUNCE A
             • LOWER BRIDGE PRIORITY
           • HOSTS BROADCAST SENDS WITH LOWER BRIDGE PRIORITY - BPDUs
             • ATTEMPT TO BE ELECTED AS THE ROOT BRIDGE
         • NETWORK ATTACKERS CAN MANUPULATE STP
           • SPOOFING ROOT BRIDGE SWITCH
           • CHANGE THE TOPOLOGY OF A NETWORK
         • ATTACKERS CAN MAKER THEIR HOSTS APPEAR AS ROOT BRIDGE
         • AND THEFORE , CAPTURE ALL TRAFIC FOR THE IMMEDIATE SWITCHED DOMAIN
       • CDP RECONNAISSANCE
         • CAN ALSO BE USED TO DISCOVER NETWORK INFRAESTRUCTURE VULNERABILITIES
         • BEST PRATICES ?
           • DISABLE CDP ON UNTRUSTED DEVICES
           • DISABLE CDP ON EDGE PORTS CONNECT
         • ENABLED BY DEFAULT CISCO
         • EXTREMELY USEFUL IN NETWORK TROUBLESHOOTING
         • IS SENT OUT CDP-ENABLED PORTS IN A PERIODIC
           • UNENCRYPTED MULTICAT
           • UNAUTHENTICATED
         • CDP INFORMATION INCLUDES ?
           • IP ADDRESS
           • IOS SOFTWARE
           • VERSION
           • PLATAFORM , CAPABILITIES AND NATIVE VLAN