Bugtraq mailing list archives
Re: STP mitm attack idea
From: Ivan Jager <aij+ () mrph org>
Date: Thu, 29 Apr 2010 13:21:32 -0400
On Wed, Apr 28, 2010 at 05:26:09PM -0400, Jason T. Masker scribbled thusly:
Best practice is to implement layer 2 security mechanisms which would identify these ports as "access" ports and shut them down if any STP traffic was received through these interfaces. On Cisco equipment, this is known as BPDU guard. http://www.cisco.com/en/US/customer/tech/tk389/tk621/technologies_tech_note09186a008009482f.shtml
I don't have an account with Cisco any more, but why would shutting down the port be the right thing to do? CMU does that, and it means you have to be very careful when plugging in a higher-end switch, which was recently a problem for Computer Club. It seems like simply ignoring STP packets from that port would be just as effective and much less disruptive. Ivan
Current thread:
- STP mitm attack idea Przemyslaw Borkowski (Apr 28)
- Re: STP mitm attack idea Jann Horn (Apr 28)
- Re: STP mitm attack idea news (Apr 29)
- Re: STP mitm attack idea Joel Maslak (Apr 29)
- Re: STP mitm attack idea Jean-Christophe Baptiste (Apr 29)
- Re: STP mitm attack idea news (Apr 29)
- Re: STP mitm attack idea Jann Horn (Apr 28)
- Re: STP mitm attack idea wlet (Apr 29)
- RE: STP mitm attack idea Stefan Laudat (Apr 29)
- <Possible follow-ups>
- Re: STP mitm attack idea Jason T. Masker (Apr 29)
- Re: STP mitm attack idea Ivan Jager (Apr 29)
- RE: STP mitm attack idea Williams, Dan (Apr 30)
- Re: STP mitm attack idea Ivan Jager (Apr 29)