Am Dienstag, den 27.04.2010, 19:55 +0200 schrieb Przemyslaw Borkowski: > Second scenario: > 1. Station C and station D starts to send frames to break link beetween switch 1 and switch 2, and announce non existing connection and switch from C port on switch 1 to D port on switch 2 > > A ---- switch 1 --X-- switch 2 ----- B > | | > | | > C --no conn-- D > 2. Station A sends frame to B > 3. Frame is forwarded to C station > 4. Station C stores frame in memory > 5. After equal timing station C and station D repair link beetween switch 1 and 2 > 6. station C resends stored packet to station D (ie in tunnel or encapsulated in ip packet) > 7. stations C and D break link beetween switches 1 and 2 > 8. station D sends transmitted packet to station B If you had a WLAN-link, you could simplify that a lot - as far as I understand, you are able to make the switches redirect the traffic to your machines. Anyway, this attack sounds like something a good switch can easily prevent by having a list of "STP trusted ports" or something like that. Doesn't that exist?
Attachment:
signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil
