CAM Table Overflow
This section first reviews exactly how the CAM table operates, so that you appreciate how easily it can be comprised.
Figure 3-6 displays a typical Layer 2 switch network with one switch and three PCs labeled with MAC addresses A, B, and C to simplify the figure.
Figure 3-6 CAM Table Operation Step 1
MAC A
Port 1
MAC A
Figure 3-6 CAM Table Operation Step 1
Switch 4
MAC C
Switch 4
MAC C
Step 2
Step 2
MAC A
Port 1
MAC A
MAC B
Switch _I
MAC C
Step 3
Step 3
MAC A
Port 1
MAC A
Switch
MAC C
Switch
MAC C
CAM Table Port 1 A Port 2 B Port 3 C
Figure 3-6 displays the typical CAM table population by a Cisco switch. When Device A, with MAC address A, sends a frame destined for Device B, with MAC address B, the switch looks at the source MAC address from Port 1 and installs MAC address A into the CAM table immediately. Because this is the first frame, the switch does not know where Device B is, so the frame is copied to all other ports (2 and 3 in Figure 3-6) and awaits a response.
Device B responds to the frame from Device A and the switch installs Device B's MAC address into the CAM table. Eventually, when Device C sends a frame, the CAM table will contain all three devices.
Most CAM tables are limited in size, depending on the switch hardware, based on memory available. It is not difficult to fill a CAM table on a Cisco switch. If enough entries are entered into the CAM table before other entries are expired (based on an idle timer), the CAM table fills up to the point that no new entries can be accepted. This is how an intruder typically attacks a switch— by sending multiple frames with different source addresses attempting to overflow the CAM table so that authorized devices can no longer reside in the CAM table, which causes the switch to continuously send frames out all ports as the default until the CAM table discovers which devices reside on what interfaces.
Typically a network intruder will flood the switch with a large number of invalid-source MAC addresses until the CAM table fills up. This renders your powerful Layer 2 switch as a hub where all frames are repeated out all ports or interfaces.
Figure 3-7 displays the invalid-source MAC addresses populating the CAM table.
Figure 3-7 CAM Overflow Attack
Figure 3-7 CAM Overflow Attack
- MAC C
CAM Table Port 1 A Port 2 B Port 3 CDFG
Step 3
Switch
Port 1
MAC A
Attack continues with different Source MAC addresses.
MAC B
MAC C
CAM Table Port 1 A Port 2 B Port 3 CDFGHI
Figure 3-7 displays an intruder device labeled with the PC Device C, sending multiple packets with various source addresses labeled C, D, E, F, G, H, and I.
By continuously sending packets, the CAM table for Port 3 will continue to grow. A simple tool, freely available on the Internet, named Macof floods a switch with packets containing randomly generated source and destination MAC and IP addresses. The switch will keep building the CAM table until its memory runs out, rendering the switch to certain failure.
The only method to mitigate this style of attack is to enable MAC port security by configuring your switch ports with port security. For a large network, it is advisable to configure dynamic port security, whereby you allow dynamic security to take over any static-based configuration and allow only one MAC address to connect to the port. In an IP telephony environment (like Cisco AVVID), you would need to allow at least two MAC addresses per port, one for the IP phone and one for the PC attached to the phone.
Example 3-40 displays the command syntax to enable port security on a Catalyst-based operating system.
|
set |
port |
security |
mod/port enable [MAC_addr] |
|
set |
port |
security |
mod/port MAC_addr |
|
set |
port |
security |
mod/port maximum num_of_MAC |
|
set |
port |
security |
mod/port violation |
|
set |
port |
security |
mod/port age |
|
set |
port |
security |
mod/port shutdown shutdown-time |
Example 3-41 displays the equivalent commands for Cisco IOS-based switches.
Example 3-41 Cisco IOS Port Security Configuration Commands
|
Router(config |
if |
# |
switchport |
port |
security |
|
Router(config |
if |
# |
switchport |
port |
security maximum value |
|
Router(config |
if |
# |
switchport |
port |
security violation {protect | restrict | shutdown} |
|
Router(config |
if |
# |
switchport |
port |
security MAC-address MAC-address |
|
Router(config |
if |
# |
switchport |
port |
security aging |
Continue reading here: VLAN Hopping
Was this article helpful?