Hello, i have read many doc about this attack but there are many contradictions.
I hnow that this exploit exist in 2 ways :
Basic=> The attacker spoof a switch and gains the trunked states of the switch's port. Rely on auto-negotiate feature turned ON. This ways is simple to understand.
****************************************************************** Complex 1 => This attack is described on
formatting link
and to work need that the attacker and the trunk share same native vlan ( ex. VLAN 10 ). In this doc. that the attacker send on the access port ( VLAN 10 ) a tagged frame with a VLAN-ID of target VLAN ( ex. VLAN 20 ) . The switch takes frame and forward it on trunk port without native tag (10). The other switch read VLAN-ID(20) and forward frame on the access vlan 20. In this scenario my doubts is :
1) Why the first SW accepts tagged frame but does'nt read the tags ? Is this behavior an anomaly of work ?
2) Why the last switch that receives native frame on trunk port reads the VLAN-ID ? Is this normal or anomaly ? I think that sw does'nt read VLAN-ID because the frame on trunk is native .
******************************************************************
Complex 2 => In other docs per ex:
formatting link
there is an attack called " Double-Encapsulated 802.1Q ". In this exploit the conditions are similar to the precedent but the attacker need to insert two VLAN-ID ( outer,inner ). If this case work then :
1) The first switch read VLAN-ID on access port and forward frame on trunk ( strip off first VLAN-ID ) . This behavior is different that precedent case . Why the switch forward this frame according to VLAN-ID on the access-port ? Is this behavior another anomalies ?
******************************************************************
Sorry about lenght of post.
Thanks
Giuseppe Citerna ccie#1053
Complex 2 => This
read more and respond »
Posted 5 years ago
by Jos_Cit
in Cisco Systems
Report misuse
