ccna 6th edition pdf

ccna 6th edition pdf.6.2.3.1 MAC Address Table Overflow AttacksIn addition to MAC spoofing attacks, Layer 2 devices are also vulnerable to MAC address table overflow hits. Remember that switches use MAC addresses to manage network traffic through their switching matrices, forwarding traffic to the appropriate end of the node going to the day. A matrix is the integrated circuit and corresponding machine program that ensures the operation of a device. For example, the switching matrix is responsible for controlling the data path through the switch. The MAC address table within the switch contains the MAC addresses that can be reached by a given physical port of the switch and the VLAN parameters associated with each MAC address. When a Layer 2 switch receives a data frame, the switch looks up the MAC address table to find the destination MAC address and then forwards the data frame.The key to understanding how MAC address table overflow attacks work is to know that there is a limit to the space in the MAC address table. MAC flooding takes advantage of this limitation by using a large number of fake source MAC addresses to attack the switch until the switch's MAC address table is full. If enough entries have made it to the MAC address table before the old ones expire, the table no longer accepts any new entries. When this happens, the switch starts flooding incoming traffic to all ports because there is no room in the table to learn any legitimate MAC addresses. At this point the switch, by its very nature, becomes a hub. The end result is that an attacker can see all the data frames sent from one host to another. Since traffic is only flooded within the local VLAN, the intruder can only see traffic within the local VLAN to which the intruder is connected.If the intruder cannot maintain flooding of invalid source MAC addresses, the switch eventually removes the old MAC addresses from the table due to their aging and will perform the function of going back to the switch again.6.2.3.2 macof toolsThe most common method of performing a MAC address table overflow attack is to use the macof I tool. This tool floods data frames to the switch with randomly generated source and destination MAC and IP addresses contained in the frames. In a very short period of time, the MAC address table fills up. When the MAC address table is invalidated6.2 Layer 2 Security Considerations 155of source MAC addresses is filled, the switch starts flooding all the data frames it receives. The switch's table will remain filled as long as macof remains operational, and the switch will keep flooding all received data frames to each port. This would allow an attacker to send packets to an otherwise unreachable device.Both attacks, MAC spoofing and MAC address table overflow, can be eliminated by configuring port security on the switch. Using port security, administrators can statically assign MAC addresses to specific switch ports or allow the switch to dynamically learn a fixed number of MAC addresses for its ports. Static assignment of MAC addresses is not a manageable solution in a production environment, while allowing the switch to dynamically learn a fixed number of MAC addresses is a manageable and scalable solution.6.2.4 STP Manipulation Attacks