Describes the correspondence between vswitch ACM tables

All current vswitches support full duplex. The advantage of full duplex is that the delay is small and the speed is fast. So what is the ACM table of the switch? Let me enter the ACM table world of this switch. I hope you can learn it for reference.

It may be a bit strange to see this question. No one in the cybersecurity circle has defined such a term. At first, I am not sure what kind of term to define, I just defined such a term according to the original term of the attack. If there is a better suggestion to give him a better name, such as "pandatv incense", it is well known.

I do not know whether this attack method has been studied. I have never seen it on the internet. Recently, I have spent some time thinking about this attack technology, we hope to provide another cornerstone for Security Technology enthusiasts, but we do not want everyone to use it for network damage. The consequences are very serious and the network administrator is angry because he cannot find the attack source, currently, there is no good solution to this type of attack, so you may think twice.

I spoke a lot of nonsense and entered the topic.

At first, the discovery of such attacks was an early source of ARP Protocol learning and research. At that time, it was found that sending ARP packets in a specific format would have a certain impact on the network. If I was a B server, capture the ARP return packet sent from machine C to machine A, and Use sniffer pro to capture the packet on machine B for replaying.

That is to say, the B server sends such data packets as the source MAC is a C machine, and the number of packets sent when the switch receives such continuous data packets is closely related to the attack effect) machine C suddenly lost contact with other machines on the network, and other machines on the network could not access machine C. According to packet capture, it was found that data packets of machine C could be sent out, I just didn't receive the response packet. Where is the problem ?.

People with ideas will surely think that the packets are forwarded to the B server by the switch. To prove our ideas, we can capture packets on the B server and find that, many data packets are the response packets from other IP addresses to machine C. Many people will not understand why. You know the difference between a vswitch and a HUB.

The switch does not broadcast packets. The working mode is: machine A ---> machine B's data packets cannot be received by machine C, and the switch should have A forwarding list ACM ), the role of the AMC table is to establish the correspondence between the MAC address and the port.

A port can correspond to many MAC addresses, and only one port can be set up in 802.1x). This seems to be okay. The problem is that ACM is dynamically updated in real time, now, let's take a look at the problem above.

It is no problem for machine C to send data packets to machine A. the MAC of machine C establishes A temporary correspondence between the three ports. If machine A communicates with machine C after receiving the data packets, the switch will direct the data packet to three ports, and the data connection between them will succeed.

Continuous replay is performed when the B server captures this data packet. Just now, it also said that the data packet sent from the B server with the source address of the MAC address of the C machine is sent, when a packet passes through the switch, the correspondence between the MAC address of the C machine and the three ports is changed. The switch finds that the source MAC address of the packet is sent from the two ports of the switch.

Therefore, the relationship between the MAC address of machine C and the vswitch ACM table will be established, and the data packets sent from machine A to machine C will be completely forwarded by the switch to the port B of Machine 2, all of these have led to the disconnection of the C machine. Now, we should understand that the above is my own understanding. Some problems may be explained in some places. I hope you can raise them.

Some people will say that the C machine is constantly sending packets, and it will also change the correspondence between the MAC and Port 2 of the C machine in the ACM table of the switch. As mentioned above, this depends on the number of data packets replayed by machine B. After my tests, we found that machine B replayed-data packets per second at the same time.

Machine C should be unable to communicate with machines or communicate very slowly. It is interesting that other machines can be pinged on machine C, which makes machine C quite depressing, in addition, machine C cannot receive any attack data packets. It should be the data packet corresponding to machine A of C, which is not broadcast. For example, if the number of data packets is about 10 thousand, machine C cannot receive any information.

You will also say why packet broadcasting is not performed. If packets should be broadcast, it will have a great impact on the switch, it will have an impact on other machines, and it is easy for others to discover such packets, although he cannot find you without checking the MAC table of the switch, he is afraid of reading it ).

If your network is very large, broadcast will also affect your use of it. Therefore, we need to make targeted transmission of data packets and find a zombie, in the above case, A is our slave machine. If there is another D machine, we won't be able to find this attack when we capture packets on the D machine. Is it terrible? What's more terrible, everybody has to worry about it again, since we can launch attacks on a single machine.

You can also launch an attack on the gateway. What is the consequence of an attack on the gateway? That is, no one can communicate with the gateway, and all networks are disconnected, including yourself ), you only need to send the data packet whose source address is gateway on machine B.

We have already said that the broadcast package is the least desirable, so we need to find A zombie machine and still find machine A. No, this is because machine B and machine A are in the same vswitch. All that can be changed is the ACM table of this vswitch, which only affects the machines under this vswitch, how can we break through the scope? The broadcast is okay, but it is the most unfeasible method. What should we do?

Rest assured that smart people will always have a solution. At this time, the role of the slave machine is apparent. In professional terms, the slave machine sends packets whose source address is the gateway MAC address from the B server, all the switches it passes through are changed to the corresponding relationship with the ACM table of the Gateway Switch.

That is to say, how far a slave machine is, how far we attack a switch. Therefore, it is very important to select the network topology where the slave machine is located. It determines the range of the attack switch. If I want to disconnect the entire network, I will switch the following machine as a zombie machine in the trunk. Is it so bad.

1. Let's talk about the "potential rules" of the security switch"
2. Summarize the market status of high-end Switches
3. Security risks of LAN switches
4. PythonAndroid analyzes the differences and relationships between layer-3 switches and other layer Switches
5. Measure the Power Consumption Characteristics of LAN switches.