Re: STP mitm attack idea

[Jann Horn <jannhorn () googlemail com>]

Am Dienstag, den 27.04.2010, 19:55 +0200 schrieb Przemyslaw Borkowski:
> Second scenario:
> 1. Station C and station D starts to send frames to break link beetween switch 1 and switch 2, and announce non 
> existing connection and switch from C port on switch 1 to D port on switch 2
>
> A ---- switch 1 --X-- switch 2 ----- B
>           |              |
>           |              |
>           C  --no conn-- D
> 2. Station A sends frame to B
> 3. Frame is forwarded to C station
> 4. Station C stores frame in memory
> 5. After equal timing station C and station D repair link beetween switch 1 and 2
> 6. station C resends stored packet to station D (ie in tunnel or encapsulated in ip packet)
> 7. stations C and D break link beetween switches 1 and 2
> 8. station D sends transmitted packet to station B

If you had a WLAN-link, you could simplify that a lot - as far as I
understand, you are able to make the switches redirect the traffic to
your machines.
Anyway, this attack sounds like something a good switch can easily
prevent by having a list of "STP trusted ports" or something like that.
Doesn't that exist?

Attachment: signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil