Anatomy of a Switch
A simplified view of a switch is that it has a central CPU and special forwarding ASICs. The CPU is responsible for building up the forwarding tables and allowing ASICs to perform forwarding in hardware, which makes switching an efficient process.
Figure 12-2 shows the architecture of a typical LAN switch.
Figure 12-2 LAN Switch Architecture
Figure 12-2 shows the architecture of a typical LAN switch.
Some high-end switches use distributed forwarding architecture, using numerous dedicated CPUs to control the forwarding logic on different line cards.
Regardless of its architecture, a switch initially has little information about its environment or on which physical ports the different destinations reside when it is powered up. This requires some kind of learning to happen, which is then used to create databases that contain information about all possible destinations. These databases are often called forwarding tables (or bridging).
To perform this learning process, the central CPU and/or the distributed CPUs come into play. They then update the forwarding tables that the hardware ASICs use.
From a vulnerability standpoint, if those CPUs can be kept busy, they cannot update the forwarding tables or—in the worst case—they cannot perform the required routing housekeeping tasks. This can cause the device to be unable to forward packets for new devices on the network or, in the most extreme cases, cause serious instabilities that might cause packet forwarding to completely stop. Also, the switch might start to flood packets to all ports in a VLAN because it is unable to learn on which ports new devices reside.
Higher end platforms will, in most cases, continue to forward traffic based on existing information stored in the line card forwarding tables.
Continue reading here: Management Plane Attacks
Was this article helpful?