Re: Vlan Hopping Vulnerability


Jos_Cit wrote:

> 2) Complex 1 => This attack is described on
> http://www.sans.org/resources/idfaq/vlan.php and to work need that the
> attacker and the trunk share same native vlan ( ex. VLAN 10 ). In this
> doc. the attacker send on the access port ( VLAN 10 ) a tagged frame
> with a VLAN-ID of target VLAN ( ex. VLAN 20 ) . The switch takes frame
> and forward it on trunk port without native tag (10). The other switch
> (connected via-trunk) read VLAN-ID(20) and forward frame on the access
> vlan 20.

I looked up Cisco's website, and native VLAN appears to be a way of
configuring only one of the VLANs to be untagged on a trunk since
normally trunks need to have all traffic tagged.

> In this scenario my doubts is :
>
> - Why the first SW accepts tagged frame ?
> Is this behavior an anomaly of work ?

There is no way in the standard to have a port accept only
untagged frames. There is a control variable called
"Acceptable Frame Types" and that can be set to be:
- Accept all frames
- Accept only tagged frames.

So normally an "access" port will accept tagged frames
as well. However, if the switch has ingress filtering
enabled (and this is optional in the standard and not default
behavior), then the switch would have dropped the incoming
frame since it would have had a VLAN tag for a VLAN of which
it was not a member.

It looks like this switch is processing the frame as
being on VLAN 20 all the way.

> - Why the last switch that receives native frame on trunk port reads
> the VLAN-ID ? Is this normal or anomaly ? I think that sw does'nt read
> VLAN-ID because the frame on trunk is native .

This is normal. The VLAN ID (20) is the non-native VLAN
of the trunk and so the switch will read it and classify
the frame as being on VLAN 20 and forward it accordingly.

>
> 2)Complex 2 => In other docs per ex:
> http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_...
> there is an attack called " Double-Encapsulated 802.1Q ". In this
> exploit the conditions are similar to the
> precedent but the attacker need to insert two VLAN-ID ( outer,inner ).
> If this case work then the first switch read VLAN-ID on access port and
> forward frame on trunk ( strip off first VLAN-ID ) . This behavior is
> different that
> precedent case . Why the switch forward this frame according to VLAN-ID
>
> on the access-port ? Is this behavior another anomalies ?

The behavior is normal for the given configuration.

This again looks like an anomaly due to the notion of a native
VLAN which allows you to send the native VLAN untagged on
a trunk. The first switch receives a QinQ frame on a port
that expects to see only a single tag. Because it is
forwarding it on a trunk, and outer tag based on which it
is doing its forwarding, is equal to the native VLAN it
untags the frame. In the normal "good case" the receiving
switch would have picked up this frame and tagged it using
the native VLAN. However, in this case, the frame already
has a tag (the inner one) and so the receiving switch
classifies and forwards the frame based on that.

Per the white paper this can be avoided by not using the
native VLAN.

Anoop

.

Relevant Pages

  • Re: bond interface arp, vlan and trunk / network question
    ... So far vlan and trunking works as expected. ... The exact problem is that the bonding driver don't switch the ... interface because the mii-tool don't recognize that the connection ... serverinterface is connected via a trunk to one of the switches. ...
    (Linux-Kernel)
  • Re: VLAN on 3750
    ... There will be a trunk between 3750 to each ... VLANs in use on each switch. ... VTP does have a major gotcha that should be well-known to any network ... to maintain updating vlan names on every switch in a 50 switch ...
    (comp.dcom.sys.cisco)
  • Re: VLAN on 3750
    ... There will be a trunk between 3750 to each ... VLANs in use on each switch. ... VTP does have a major gotcha that should be well-known to any network ... to maintain updating vlan names on every switch in a 50 switch ...
    (comp.dcom.sys.cisco)
  • Re: CDP-4-NATIVE_VLAN_MISMATCH
    ... Port 47 on the client switch is running: ... So you've got an ISL trunk on 0/47 on switch A ... mentioned interface) is configured as an access port that calls VLAN 3 ... Depends on whether or not you need the wire between these two ports 47 ...
    (comp.dcom.sys.cisco)
  • Re: Query related to a stp and vlan case
    ... Think about what a switch would do with a frame arriving at one port, ... are members of that VLAN X. ... The frame will get dropped on the floor. ... If you make even those PC links trunk segments, and the PCs themselves ...
    (comp.dcom.lans.ethernet)
Quantcast