Answer to Question #252286 in Computer Networks for Nicki

Question

Q.4.1 You have configured a switch on your network. Your organisation has asked you to

provide possible solutions or defences for the following attacks.

Write down one security defence for each of the following presented attacks and

indicate the type of attack that it is:

Attack A:

An attacker connects his device to the switch’s mirror port.

Attack B:

An attacker overflows the switch’s address table with fake MAC addresses, forcing

it to act like a hub, sending packets to all devices.

Attack C:

The attacker sends a forged ARP packet to the source device, substituting the

attacker’s computer MAC address.

Answer 1

Attack A:

The type of attack is a Port mirroring attack; the security defense is by any port-mirroring features on a SAN switch are disabled if they are not in use. The act of disabling the port helps to prevent attacks from aging access to configured data within SAN.

Attack B:

The type of attack is CAM table flooding attack or MAC address flooding attack.

Port security is the security defense to stop the CAM table flooding attack. Port security restricts, the port and number of addresses the MAC table can learn are restricted.

Attack C:

The type of attack is ARP Spoofing also refers to ARP Poisoning.

Passive: Monitor ARP traffic and look for mapping inconsistencies, is a defense against ARP Spoofing.