Port Security
Port security allows the switch's administrator to limit the number of MAC addresses that can appear on a given LAN port. The limit can be manually set or the switch can be instructed to lock down on the first dynamically learned address. It's usually possible to save the list of addresses dynamically learned so they can survive a reboot.
When a port-security violation is detected, several actions can ensue. The port can be brought down when more than n MAC addresses show up or traffic from an unauthorized MAC address can be silently dropped. Actions vary from switch to switch, but generally speaking, the vast majority of switches on the market include some form of port security. (For specifics, consult your switch's documentation.)
Example 5-2 provides a configuration example for a Cisco Catalyst 6500 running Cisco IOS operating system (OS), along with the message produced when a violation occurs.
Example 5-2 Port Security Configuration and Violation Detection
6K-1-720(config)# interface g1/1 6K-1-720(config-if)# switchport port-security ?
aging Port-security aging commands mac-address Secure mac address maximum Max secure addresses violation Security violation mode <cr>
6K-1-720(config-if)# switchport port-security violation protect Security violation protect mode restrict Security violation restrict mode shutdown Security violation shutdown mode
The configuration listed in Example 5-2 shows the user-configurable actions that can be taken when a security violation occurs.
Unfortunately, both Yersinia and Gobbler permit a more evolved version of the starvation attack. Both tools can multiplex multiple DHCP requests on top of a single source MAC address. To understand how this is possible, refer to the DHCP packet format shown in Figure 5-2 and Table 5-2. Both attack tools can randomize a critical field called the Client Hardware Address field while using a single unique Ethernet source MAC address, as Figure 5-5 shows.
To the DHCP server, each packet constitutes a single valid request. To the switch, things look more normal. Only one MAC address is learned on the attacker's port.
Figure 5-5 Advanced DHCP Exhaustion: Client Hardware Randomization
Figure 5-5 Advanced DHCP Exhaustion: Client Hardware Randomization
In Figure 5-5, you see that the Ethernet source MAC address differs from the Client Hardware Address field inside the DHCP message.
Hackers probably developed this feature to circumvent port security. Because no more than one MAC address appears on the port, port security does not register any suspicious activity. The solution to this attack is more involved: The switch must somehow have sufficient intelligence to peek inside DHCP packets and identify abnormal behavior. For this purpose, Cisco developed and patented a mechanism called DHCP snooping.
Another Limit of Port Security
Port security is an excellent mitigation technique against MAC flooding attacks. (See Chapter 2, "Defeating a Learning Bridge's Forwarding Process.") It must be deployed for this reason.
However, using port security to prevent DHCP exhaustion is definitely not enough. Because the DHCP lease time is usually several days and because the port-security timers are in the order of minutes, a smart hacker can change its MAC address slowly enough to bypass the port-security feature and still get a lease from the DHCP server. In short, port security has only a limited value to fight DHCP exhaustion.
This is the reason for the interest in DHCP snooping.
Continue reading here: Introducing DHCP Snooping
Was this article helpful?