BPDU Filtering
There is actually another method to discard incoming and outgoing BPDUs on a given port: BPDU filtering. This feature silently discards both incoming and outgoing BPDUs. Although extremely efficient against a brute-force DoS attack, BPDU filtering offers an immense potential to shoot yourself in the foot. Enable this feature on the incorrect port, and any loop condition goes undetected forever, which causes instantaneous network downtime. On the other hand, not sending out BPDUs is actually a good thing when faced with a hacker using Yersinia. Yersinia listens for BPDUs in order to craft its own packets based on information contained in genuine BPDUs. If the tool isn't fed any data to start with, it slightly complicates the hacker's job; I say it only "slightly complicates" because Yersinia is a powerful tool when it comes to exploiting STP: It comes with a prefabricated BPDU ready to be sent on the wire! Because of its danger potential, use BPDU filtering with extreme caution and only after you clearly understand its potential negative effects. Suppose, for example, that a user accidentally connects two ports of the same switch. STP would normally take care of this loop condition. With BPDU filtering enabled, it is not taken care of, and packets loop forever! Only enable it toward end-station ports. It is enabled on a port basis using the spanning-tree bpdufilter enable command, as Example 3-7 shows.
Example 3-7 How to Enable BPDU Filtering on a Port
|
6K-3-S720(config)#interface f5/14 |
|
|
6K-3-S720(config-if)#spanning-tree bpdufilter enable |
|
|
6K-3-S720(config-if)#~Z |
|
|
6K-3-S720# |
|
|
*Dec 30 19:26:37.066: %SYS-5-CONFIG I: Configured from |
console by vty0 |
|
(10.48.82.102) |
|
|
6K-3-S720#sh spanning-tree vlan 1448 int f5/14 detail |
include filter |
|
Bpdu filter is enabled |
|
|
6K-3-S720# |
As soon as either BPDU-guard or BPDU filtering is enabled, the CPU utilization returns to normal.
Continue reading here: Layer 2 PDU Rate Limiter
Was this article helpful?