
525252
© 2002, Cisco Systems, Inc. All rights reserved.
l2-security-bh.ppt
Spanning Tree Attacks and Methods
¥ Standard 802.1d STP takes 30-45
seconds to deal with a failure or
Root bridge change (nice DoS)
Generally only devices affected by the
failure notice the issue
PortFast and UplinkFast can greatly
improve this
¥ Sending BPDUs from the attacker
can force these changes and create
a DoS condition on the network
¥ As a link with macof: the TCN
message will result in the CAM table
aging all entries in 15 seconds if
they do not communicate (the
default is 300 seconds)
¥ Testing using brconfig on OpenBSD
was easily able to create the DoS
condition. Depending on the
topology it could also yield more
packets available for the attacker
Comentarios a estos manuales