Cisco Switch Security: MAC Address Spoofing, Table Overflows, and VLAN Attacks Mitigation, Lecture notes of Computer Networks

Download Cisco Switch Security: MAC Address Spoofing, Table Overflows, and VLAN Attacks Mitigation and more Lecture notes Computer Networks in PDF only on Docsity!

• A switch makes a decision based on ingress and a destination port.
• A LAN switch keeps a table that it uses to determine how to forward traffic through the switch.
• Cisco LAN switches forward Ethernet frames based on the destination MAC address of the frames.

• A VLAN is a logical partition of a Layer 2 network.
• Multiple partitions can be created, allowing for multiple VLANs to co-exist.
• Each VLAN is a broadcast domain, usually with its own IP network.
• VLANs are mutually isolated and packets can only pass between them via a router.
• The partitioning of the Layer 2 network takes place inside a Layer 2 device, usually via a switch.
• The hosts grouped within a VLAN are unaware of the VLAN’s existence.

• Data VLAN
• Default VLAN
• Native VLAN
• Management VLAN

• VLANs can be used to limit the reach of broadcast frames.
• A VLAN is a broadcast domain of its own.
• A broadcast frame sent by a device in a specific VLAN is forwarded within that VLAN only.
• VLANs help control the reach of broadcast frames and their impact in the network.
• Unicast and multicast frames are forwarded within the originating VLAN.

• Frames that belong to the native VLAN are not tagged.
• Frames received untagged remain untagged and are placed in the native VLAN when forwarded.
• If there are no ports associated to the native VLAN and no other trunk links, an untagged frame is dropped.
• In Cisco switches, the native VLAN is VLAN 1, by default.