Mod 10 LAN Security

DDoS attack

A coordinated attack using many compromised devices called zombies to overwhelm or disrupt a service.

Data breach

An attack in which confidential information is accessed or stolen.

Malware

Malicious software that infects or compromises a system.

Ransomware

Malware that encrypts files and demands payment to restore access.

Phishing

An attack that tricks users into clicking malicious links or opening attachments.

Spear phishing

Phishing that targets specific people, often executives or privileged employees.

VPN-enabled router

A device that provides secure remote access across a public network.

NGFW

A next-generation firewall that provides stateful inspection, application control, intrusion prevention, malware protection, and URL filtering.

NAC

Network Access Control; manages network access through authentication, authorization, and accounting.

ESA

Email Security Appliance; monitors SMTP traffic and helps block email threats and prevent data loss.

WSA

Web Security Appliance; controls web access using URL filtering, malware scanning, and application controls.

Endpoint protection

Security tools that protect devices such as computers, servers, and IP phones from threats.

AAA

Authentication, Authorization, and Accounting; the framework used to control and track access.

Authentication

Verifies who a user is.

Authorization

Determines what an authenticated user is allowed to do.

Accounting

Records user activity, commands, connection times, and resource usage.

Local AAA

Stores user credentials locally on a network device.

Server-based AAA

Uses a central server to authenticate users across multiple network devices.

RADIUS

A protocol used by network devices to communicate with a central AAA server.

TACACS+

A protocol used by network devices to communicate with a central AAA server.

SSH

A secure remote-access protocol that encrypts login information during transmission.

802.1X

A port-based authentication standard that restricts unauthorized devices from accessing a LAN.

Supplicant

The client device requesting access through 802.1X.

Authenticator

The switch or wireless access point that controls network access based on authentication status.

Authentication server

The server that verifies a client's identity and determines whether access is authorized.

Layer 2 attack

An attack targeting the data-link layer or local switching infrastructure.

MAC address table

A switch table used to associate learned MAC addresses with VLANs and ports.

MAC address flooding

An attack that fills a switch's MAC address table with fake source MAC addresses.

Effect of a successful MAC flooding attack

The switch floods unknown unicast frames out ports within the affected VLAN, potentially exposing traffic to the attacker.

Goal of MAC address flooding

Allow the attacker to capture frames intended for other devices on the same VLAN.

MAC flooding tool

macof is an example of a tool used to generate traffic for MAC address table flooding.

MAC flooding mitigation

Port security limits the number of source MAC addresses learned on a switch port.

Port security

A switch feature that restricts the number of source MAC addresses learned on a port.

VLAN hopping

An attack that attempts to access traffic from other VLANs by tricking a switch into forming a trunk.

802.1Q

A VLAN tagging protocol used to identify VLANs on trunk links.

DTP

Dynamic Trunking Protocol; a Cisco-proprietary protocol used to negotiate trunk links.

VLAN hopping mitigation

Disable trunking on access ports and disable automatic trunk negotiation on trunk links.

VLAN double-tagging

An attack that places two 802.1Q tags in a frame to try to send traffic into a target VLAN.

VLAN double-tagging limitation

The attack is unidirectional and depends on the attacker's port being in the trunk's native VLAN.

Native VLAN

The VLAN whose traffic is carried untagged across an 802.1Q trunk.

DHCP

Dynamically provides hosts with IP configuration such as addresses, subnet masks, gateways, and DNS servers.

DHCP message order

DORA: DHCPDISCOVER, DHCPOFFER, DHCPREQUEST, DHCPACK.

DHCPDISCOVER

The client's broadcast message searching for a DHCP server.

DHCPOFFER

The DHCP server's message offering an IP address and configuration.

DHCPREQUEST

The client's message requesting or accepting an offered IP configuration.

DHCPACK

The DHCP server's acknowledgment confirming the client's lease.

DHCP starvation

An attack that exhausts a DHCP address pool by requesting leases with bogus MAC addresses.

DHCP starvation goal

Prevent legitimate clients from obtaining IP addresses.

DHCP spoofing

An attack in which a rogue DHCP server provides false IP configuration to clients.

Rogue DHCP server

A DHCP server controlled by an attacker that may provide false gateway, DNS, or IP settings.

DHCP spoofing risk

A malicious default gateway or DNS server can redirect traffic or enable man-in-the-middle attacks.

DHCP snooping

A switch security feature that helps mitigate DHCP starvation and DHCP spoofing.

ARP

Address Resolution Protocol; resolves an IPv4 address to a MAC address on a local network.

ARP spoofing

An attack that sends false ARP information associating the attacker's MAC address with another device's IP address.

ARP poisoning

Corrupting devices' ARP caches with false IP-to-MAC mappings.

ARP poisoning consequence

Can enable a man-in-the-middle attack by redirecting traffic through the attacker.

Gratuitous ARP

An unsolicited ARP message that can cause hosts to update their ARP tables.

DAI

Dynamic ARP Inspection; mitigates ARP spoofing and ARP poisoning.

Address spoofing

An attack that uses a fake MAC address or IP address to impersonate another device.

MAC address spoofing

Changing a device's MAC address to match another device's MAC address.

Effect of MAC spoofing

The switch may associate the target MAC address with the attacker's port and forward the target's traffic there.

IP address spoofing

Using another device's IP address or a randomly chosen IP address.

IPSG

IP Source Guard; the mitigation identified in the module for MAC and IP address spoofing.

STP

Spanning Tree Protocol; helps prevent Layer 2 switching loops.

STP attack

An attack that manipulates spanning tree by sending forged BPDUs to influence root bridge election.

BPDU

Bridge Protocol Data Unit; carries spanning-tree information between switches.

STP attack priority clue

A forged BPDU advertising a lower bridge priority, such as priority 0, attempts to make the attacker's device the root bridge.

STP attack goal

Manipulate the switching topology and potentially capture traffic within the switched domain.

CDP

Cisco Discovery Protocol; a proprietary Layer 2 protocol that discovers information about directly connected Cisco devices.

CDP reconnaissance

Discovering network information such as device IP addresses, IOS versions, platforms, and native VLANs through CDP.

CDP security risk

CDP information is sent unencrypted and unauthenticated, so an attacker may use it to identify vulnerabilities.

Disable CDP globally

no cdp run disables CDP globally on a Cisco device.

Disable CDP on an interface

no cdp enable disables CDP on a specific interface.

LLDP

Link Layer Discovery Protocol; a discovery protocol that can also expose network device information.

Layer 3–7 security protections

VPNs, firewalls, and intrusion prevention systems (IPS) protect network layers 3 through 7.

Why Layer 2 security matters

If Layer 2 is compromised, attackers may capture traffic and undermine protections at higher layers.