Analysis of snooping safety technology

DHCP simplifies configuration and improves management efficiency. But it also poses a security risk.

Common to have:

Rogue (rouge) DHCP server

• DHCP depletion attacks

L IP Address conflict

A rogue (rouge) DHCP server

Because there is no authentication mechanism between the DHCP server and the client, a rogue DHCP server is arbitrarily erected on the network, assigning the wrong IP address to the client, which will cause great harm to the network.

Two DHCP exhaustion attacks

Typically, the DHCP server judges the customer's Mac by checking the CHADDR (client host MAC address) field in the DHCP message sent by the client. In general, it should be the same as the real MAC address of the client who sent the paper.

Although port security can be used to restrict each port to use only a unique MAC address. However, if the attacker does not modify the source MAC address of the DHCP request message, but instead modifies the CHADDR field in the DHCP message to implement the attack, it can bypass the port security check.

Both Yersinia and Gobble can carry out this attack.

Three IP address conflicts

Clients do not have to use the DHCP service to get IP, or you can set the IP address in a statically specified manner. This will greatly increase the likelihood of network IP address conflicts.

Introduction to DHCP snooping technology

The DHCP spanning is a control plane feature. The ability to closely monitor and restrict DHCP operations on one VLAN.

This means that you can do a depth check to see the fields within the DHCP.

Switch ports are divided into two categories:

Non-trusted ports: Usually ports connected to terminal devices, such as PCs, network printers, etc.

Back to the column page: http://www.bianceng.cnhttp://www.bianceng.cn/Network/Security/

The switch restricts user untrusted ports and can only send DHCP requests, discarding all other DHCP messages from untrusted ports. The switch restricts user untrusted ports and can only send DHCP requests, discarding all other DHCP messages from untrusted ports. And even DHCP requests. Only the source MAC address in the DHCP request message header and the hardware address (chaddr field) in the DHCP message will be forwarded only if the same request message is sent, otherwise it will be discarded. This prevents a DHCP exhaustion attack.

Trust Port: A port that connects to a legitimate DHCP server or an upstream port that connects to a converged switch

The trust port can receive all DHCP messages

By connecting only the switch legal DHCP server to the trusting port, the other ports are set to untrusted ports, which prevents users from forging a DHCP server to attack the network.

The speed limit of DHCP message can prevent the broadcast attack of DHCP request message.

Clients on untrusted ports get a legitimate DHCP offer, and the switch starts to gather information from DHCP packets to build the binding table, which includes the IP address, MAC address, VLAN, port, and lease term.

Binding Table Build Process:

The DHCP Listener binding table also provides a basis for deploying IP Source Protection (IPSG) and dynamic ARP detection (DAI).

Attention:

Once a customer uses manual settings instead of dynamically acquiring an IP address, it does not send DHCP, and there is no binding table.

If clients are required to access the network only by dynamically acquiring IP, they must rely on IPSG and Dai Technologies.

Configuration of DHCP snooping

Switch (config) #ip DHCP snooping//Turn on DHCP snooping features

Switch (config) #ip DHCP snooping VLAN 10//Set DHCP snooping feature on that Vlnan enabled

Switch (config) #ip DHCP snooping verify mac-address//Open DHCP request message source Mac and CHADDR fields are the same check, default is turned on

Switch (config-if) #ip DHCP snooping trust/Set trusted port

Switch (config-if) #ip DHCP snooping limit rate N//Limit the DHCP message rate for untrusted ports to the number of contracts per second