Re: STP mitm attack idea
Jann Horn <jannhorn@googlemail.com> wrote on 04/28/2010 12:20:55 PM:
> From:
>
> Jann Horn <jannhorn@googlemail.com>
>
....
> If you had a WLAN-link, you could simplify that a lot - as far as I
> understand, you are able to make the switches redirect the traffic to
> your machines.
> Anyway, this attack sounds like something a good switch can easily
> prevent by having a list of "STP trusted ports" or something like that.
> Doesn't that exist?
Best practice is to implement layer 2 security mechanisms which would
identify these ports as "access" ports and shut them down if any STP
traffic was received through these interfaces. On Cisco equipment,
this is known as BPDU guard.
http://www.cisco.com/en/US/customer/tech/tk389/tk621/technologies_tech_note09186a008009482f.shtml
討論串 (同標題文章)
完整討論串 (本文為第 5 之 8 篇)：