STP Attack Details (Principles and Defense)

STP attacks

, Normal STP, the data packet transmission path is PC1-> SW2-> SW3-> Server1

In this case, the attacker sets up an illegal switch Rogue in SW2 and SW3 and sets it as the root bridge. In this case, the normal path is blocked, and the data packet transmission path of PC1 to the server is changed to PC1-> SW2-> Rogue-> SW3-> Server1. Attackers can obtain data packets on the Rogue.

Defense methods

1 Root Guard

You can connect to a vswitch or participate in root election, but cannot become a root bridge.

2 BPDU Guard

When this feature is enabled under the API, the switch is not allowed to be connected. Once the packet is received by the BPDU, the interface is shut down immediately.

3 BPDU Filtering <

You can connect to a vswitch or PC. If you receive a BPDU package, discard it immediately.

From the new day