How to configure CDP flood attack? | How to prevent CDP attack?

In this blog, we will see how to completely destroy an enterprise switch & router and also see how to prevent this DoS Attack.  We are to attack the CDP Cisco discovery protocol with the help of Yersinia. This attack is very easy and extremely powerful. This attack comes under of denial-of-service attack. To make the switch fail we need a Linux machine and simulation. The protocol we are going exploit is by default enabled on Cisco routers and switches CDP.

Let’s take an overview look at CDP: -

CDP (Cisco discovery protocol) is a Cisco proprietary protocol which is designed by Cisco. CDP is used to collect information about directly connected devices. We can collect the hardware and protocol information about neighboring devices. This information is very helpful when we do troubleshoot or document the network.

this is the topology we are going to use for the lab: -

So before starting our lab let me give the overview of what is actually going to happen to our switch while doing this attack. For example, when we log into a switch and write the command show CDP neighbors. The router is going to display all the directly connected enabled CDP neighbors' devices. Like this

R1#show cdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

                  S - Switch, H - Host, I - IGMP, r - Repeater

 

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID

switch2          Fas 1/0            178         R S I     Linux Uni Eth 0/0

switch1          Fas 0/0            149         R S I     Linux Uni Eth 0/0

 

 We are going flood thousands of CDP fake packets to the switch with the help of Yersinia and these packets will freeze down the switch operating system and the switch processor will utilize its full power until it crashes. In the end switch will no longer be a switch it’s become a hub. 

you will also see a warning:

 

*Sep 21 10:02:23.606: %SYS-2-NOMEMORY: No memory available for DSensor Malloc 17

 

let's see the configuration: -

•  configure topology as per the diagram 
• configure the IP address on kali machine 
• make sure to check CPU utilization before and after attack 
• configure attack using yersinia 
• diagnose the attack and prevent this attack. 

What is Link Layer Discovery Protocol (LLDP)? | How link layer discovery protocol work? | LLDP default configuration? | how to configure LLDP?

  

Link Layer Discovery Protocol

LLDP it’s a nonproprietary protocol that works at layer 2. It is an open IEEE-standard 802.1AB.  LLDP is an alternative to CDP.  LLDP runs over the data link layer and it collects information about the neighboring devices. This information will help us in troubleshooting and documentation. LLDP and Cisco CDP work similarly but the big difference is that LLDP is a standard while CDP is a Cisco proprietary.

LLDP has similar capabilities to CDP and there is an enhanced version to specifically address the voice application this version is called LLDP-MED (media endpoint discovery) but LLDP and LLDP-MED are not compatible.

LLDP supports a defined set of attributes that contain a T-type, L-length, and V-value, these are called TLVs. It is used to discover neighbors’ devices. LLDP support devices use TLV to send and receive information and store the information in a local table.

How link layer discovery protocol work?

First, you must enable it on the devices because by default LLDP is disabled, and remember not all Cisco IOS routers support LLDP. LLDP-enabled devices send LLDP advertisements to LLDP neighbors and the information is stored in the MIB database locally. This information can be accessed using SNMP.

What information is stored?

• Device name and description
• Port name
• IP management address
• Capabilities
• MAC address
• MDI power
• Link aggregation
• VLAN

 

LLDP default configuration: -

IOU1(config)#lldp ?

  holdtime    Specify the holdtime (in sec) to be sent in packets

  reinit      Delay (in sec) for LLDP initialization on any interface

  run         Enable LLDP

  timer       Specify the rate at which LLDP packets are sent (in seconds)

  tlv-select Selection of LLDP TLVs to send

• LLDP is disabled by default
• LLDP hold time – 120 seconds
• LLDP reinitialization delay – 2 seconds
• LLDP timer (packet update frequency) – 30 seconds
• LLDP tlv-select – to send and receive all TLVs.

 

Let's see the configuration: -

 Topology; -

 

•  configure the topology as per the diagram.
• configure Trunk 802.1q
• enable LLDP in global configuration mode.
• change the hold time to 180,  reinit to 5 sec, and the timer to 20 sec.
• clear the LLDP table.
• disable the LLDP

 

 

 

What is Cisco discovery protocol? | How to configure CDP? | CDP

In most networks, we have several routers, switches, and more. We want to make management for networks easy, most of the admins take the help of CDP and LLDP to know about what type of devices are present in the network, the IP addresses, and how all the devices are connected with each other (which means the interface or port) and the information about which VLAN they belong.

Cisco discovery protocol

 

CDP (Cisco discovery protocol) is a Cisco proprietary protocol which is designed by Cisco. CDP is used to collect information about directly connected devices. We can collect the hardware and protocol information about neighboring devices. This information is very helpful when we do troubleshoot or document the network.

What information do we collect from neighbors?

• Device ID means the hostname of the neighbor.
• The local interface is the port on which CDP enables the device to receive the CDP packets.
• Hold time means the router's remaining amount of time is left to hold the information before the router is discarding it. The router discards the information if no more CDP packets are received. {You can choose the length from 10 – 255 seconds.}
• Capability means what is the capability of the neighbor it’s a router or switch or it’s a repeater.
• Platform means the type of Cisco device directly connected. In the previous output,
• Port ID means the neighbor device’s port or interface on which the CDP packets are multicasting.

 Let's see the configuration and we will see some interesting show commands.

Topology: -

• configure the topology as per the diagram 
• configure the Hostname 
• assign the IPs to their respective ports as per the topology
• configure CDP in global mode. or you can also configure CDP on an interface. 
• make sure the router-1-core will collect all the information.

What is VTP version 3, How to configure VTP version 3?

VLAN Trunking Protocol (VTP) is a Cisco proprietary protocol, as I already said VTP is used to share the VLAN configuration with other switches and maintain consistency throughout that network but information will be passed only if the switch is connected with fast Ethernet or higher ports and also it must be trunk links.7

if you are not familiar with VTP versions 1 and 2 please click the link

 here https://www.internetworks.in/2018/12/vlan-trunking-protocol-vtp.html

VTP version 3 has features of the VTP primary server the primary server is able to create, delete, and modify VLANs. The secondary server can relay process and save only. VTP version 3 supports the Extended VLANs range (1006 – 4094). And also supports Private VLANs, RSPAN VLANs, and MST. VTP version 3 is compatible with version 2, but not with version 1. VTP version 3 is protected against data overwrites its ability to fix the configuration revision number higher updating. VTP version 3 has more secure methods for authentication of clear text or hidden password protection.

let's configure VTP version 3: -  https://youtu.be/D0t29ZdO09I?si=GofAD3lfK61IsiS1

Topology: -

Goal: -

1. Configure the topology as per the diagram.
2. configure trunk Dot1q as per the topology
3. configure VTP domain name will be internetworks
4. configure version 3
5. configure password ccie123
6. Hide the password
7. configure LAYER-3-switch-1 primary server VLAN
8. Configure VLAN 10,20,30,40,50,60,70,80 and 90 on LAYER-3-switch-1 and make sure the rest of the domain switches synchronize this data.
9. configure the extended range of VLAN 2000,2001 on LAYER-3-switch-1 and make sure the rest of the domain switches synchronize this data.
10. configure MSTP on LAYER-3-switch-2 and make sure the rest of the switches synchronize this information.  

What is VLAN Access List? How to configure VACL?

 

VLAN Access List

VLAN ACL Is very useful when we want to filter traffic within the VLAN. When we configure VACL on the switch, all the packets entering the VLAN are checked against the VLAN access list. In VACL you cannot define the direction like router ACL. A VACL can either drop a matching packet, forward it, or redirect it to another interface. Notice that the VACL is applied globally to one or more VLANs listed and not to a VLAN interface switch virtual interface (SVI).

How to proceed

• 1.      Configure ACL standard or extended as per your requirement for VACL.
• 2.      Configure a VLAN access map for matching the IP hosts
• 3.      Configure the action forward or drop
• 4.      Apply the VACL map to the VLAN.
• 5.      Verify the VACL map information.

 https://youtube.com/@internetworkss

 Topology: -

• configure IP addresses on PCs as per the topology
• configure the default gateway as per the topology
• configure inter-VLAN- routing SVI
• configure IP address 10.1.1.1 on VLAN 10
• configure IP address 20.1.1.1 on VLAN 20
• at this point make sure all four PCs can ping each other 
• configure ACL 10 
• configure VACL make sure PC1 cannot communicate with any VLAN 20 PC

What is Private VLAN? How to configure Private VLAN? #PVLAN

 By default, our traffic is allowed to move unrestricted within a VLAN. One host sends packets to another host and it's heard only by the destination host this is the beauty of layer 2 switching. However, if one host sends the broadcast packet, all the remaining hosts on that VLAN listen to that broadcast and reply as per the broadcast. We can solve this if the host is connected to a local switch with VACL or configured with more VLAN but it would be nice to have the capability to segment traffic within a single VLAN, without having to use multiple VLANs. The solution is Private VLAN.

Let’s understand private VLAN with an example.

 All the devices are on a single subnet and in a single VLAN 100. All the devices can communicate but we don’t want all devices to communicate. As per the requirement, we need server 1, and server 2 should be able to share and communicate with each other and gateway but not communicate with server 3. Server 3 can only communicate with the gateway and be Isolated. This can be done with Private VLANs.

The private VLAN always has one primary VLAN. Within the primary VLAN, you will find the promiscuous port. In my picture above you can see that there’s a router connected to a promiscuous port. All other ports are able to communicate with the promiscuous port. Within the primary VLAN, you will encounter one or more secondary VLANs, there are two types:

Community VLAN: In this VLAN all the ports can communicate with each other and also the promiscuous port but not with other communities.

Isolated VLAN: In this VLAN all the ports are isolated means cannot communicate with each other or any community VLAN but they can communicate with the promiscuous port. 

 let's see the configuration: -

Topology:

 

• configure the topology as per the diagram 
• assign the IP addresses 192.168.1.0/24 subnet for all the ports
• configure fa0/0 default gateway 192.168.1.1 on the router
• configure primary VLAN 100
• configure gig 0/0 promiscuous port
• configure Community VLAN 101 assign port r gig 0/1
• configure Community VLAN 102 assigns port  gig 0/2
• configure Isolated VLAN 103 assigns port gig 0/3
• verify with show commands

Switch-1-(config)#vtp mode transparent

Device mode already VTP Transparent for VLANS.

Switch-1-(config)#VLAN 100

Switch-1-(config-vlan)#private-vlan primary

Switch-1-(config-vlan)#exit

Switch-1-(config)#VLAN 101

Switch-1-(config-vlan)#name first_community

Switch-1-(config-vlan)#private-vlan community

Switch-1-(config-vlan)#exit

Switch-1-(config)#VLAN 102

Switch-1-(config-vlan)#name second_community

Switch-1-(config-vlan)#private-vlan community

Switch-1-(config-vlan)#exit

Switch-1-(config)#VLAN 103

Switch-1-(config-vlan)#name isolate_community

Switch-1-(config-vlan)#private-vlan isolated

Switch-1-(config-vlan)#exit

Switch-1-(config)#vlan 100

Switch-1-(config-vlan)#private-vlan association 101,102,103

Switch-1-(config-vlan)#exit

Switch-1-(config)#interface gigabitEthernet 0/1

Switch-1-(config-if)#description this is a first-community-port

Switch-1-(config-if)#switchport private-vlan host-association 100 101

Switch-1-(config-if)#switchport mode private-vlan host

Switch-1-(config-if)#exit

Switch-1-(config)#interface gigabitEthernet 0/2

Switch-1-(config-if)#description this is a second-community-port

Switch-1-(config-if)#switchport private-vlan host-association 100 102

Switch-1-(config-if)#switchport mode private-vlan host

Switch-1-(config-if)#exit

Switch-1-(config)#interface gigabitEthernet 0/3

Switch-1-(config-if)#description this is a isolate-community-port

Switch-1-(config-if)#switchport private-vlan host-association 100 103

Switch-1-(config-if)#switchport mode private-vlan host

Switch-1-(config-if)#exit

switch-1-(config)#interface gigabitEthernet 0/0

switch-1-(config-if)#description this is a prom-port

switch-1-(config-if)#switchport private-vlan mapping 100 101,102,103

switch-1-(config-if)#switchport mode private-vlan promiscuous

switch-1-(config-if)#exit

switch-1-#show interfaces gigabitEthernet 0/0 switch

Name: Gi0/0

Switchport: Enabled

Administrative Mode: private-vlan promiscuous

Operational Mode: private-vlan promiscuous

Administrative Trunking Encapsulation: negotiate

Operational Trunking Encapsulation: native

Negotiation of Trunking: Off

Access Mode VLAN: 1 (default)

Trunking Native Mode VLAN: 1 (default)

Administrative Native VLAN tagging: enabled

Voice VLAN: none

Administrative private-vlan host-association: none

Administrative private-vlan mapping: 100 (VLAN100) 101 (first_community) 102 (second_community) 103 (isolate_community)

Administrative private-vlan trunk native VLAN: none

Administrative private-vlan trunk Native VLAN tagging: enabled

Administrative private-vlan trunk encapsulation: dot1q

Administrative private-vlan trunk normal VLANs: none

Administrative private-vlan trunk associations: none

Administrative private-vlan trunk mappings: none

Operational private-vlan: none

Trunking VLANs Enabled: ALL

Pruning VLANs Enabled: 2-1001

Capture Mode Disabled

Capture VLANs Allowed: ALL

Appliance trust: none

switch-1-#show interfaces gigabitEthernet 0/1 switchport

Name: Gi0/1

Switchport: Enabled

Administrative Mode: private-vlan host

Operational Mode: private-vlan host

Administrative Trunking Encapsulation: negotiate

Operational Trunking Encapsulation: native

Negotiation of Trunking: Off

Access Mode VLAN: 1 (default)

Trunking Native Mode VLAN: 1 (default)

Administrative Native VLAN tagging: enabled

Voice VLAN: none

Administrative private-vlan host-association: 100 (VLAN100) 101 (first_community)

Administrative private-vlan mapping: none

Administrative private-vlan trunk native VLAN: none

Administrative private-vlan trunk Native VLAN tagging: enabled

Administrative private-vlan trunk encapsulation: dot1q

Administrative private-vlan trunk normal VLANs: none

Administrative private-vlan trunk associations: none

Administrative private-vlan trunk mappings: none

Operational private-vlan: none

Trunking VLANs Enabled: ALL

Pruning VLANs Enabled: 2-1001

Capture Mode Disabled

Capture VLANs Allowed: ALL

Appliance trust: none

switch-1-#show interfaces gigabitEthernet 0/2 switchport

Name: Gi0/2

Switchport: Enabled

Administrative Mode: private-vlan host

Operational Mode: private-vlan host

Administrative Trunking Encapsulation: negotiate

Operational Trunking Encapsulation: native

Negotiation of Trunking: Off

Access Mode VLAN: 1 (default)

Trunking Native Mode VLAN: 1 (default)

Administrative Native VLAN tagging: enabled

Voice VLAN: none

Administrative private-vlan host-association: 100 (VLAN100) 102 (second_community)

Administrative private-vlan mapping: none

Administrative private-vlan trunk native VLAN: none

Administrative private-vlan trunk Native VLAN tagging: enabled

Administrative private-vlan trunk encapsulation: dot1q

Administrative private-vlan trunk normal VLANs: none

Administrative private-vlan trunk associations: none

Administrative private-vlan trunk mappings: none

Operational private-vlan: none

Trunking VLANs Enabled: ALL

Pruning VLANs Enabled: 2-1001

Capture Mode Disabled

Capture VLANs Allowed: ALL

Appliance trust: none

switch-1-#show interfaces gigabitEthernet 0/3 switchport

Name: Gi0/3

Switchport: Enabled

Administrative Mode: private-vlan host

Operational Mode: private-vlan host

Administrative Trunking Encapsulation: negotiate

Operational Trunking Encapsulation: native

Negotiation of Trunking: Off

Access Mode VLAN: 1 (default)

Trunking Native Mode VLAN: 1 (default)

Administrative Native VLAN tagging: enabled

Voice VLAN: none

Administrative private-vlan host-association: 100 (VLAN100) 103 (isolate_community)

Administrative private-vlan mapping: none

Administrative private-vlan trunk native VLAN: none

Administrative private-vlan trunk Native VLAN tagging: enabled

Administrative private-vlan trunk encapsulation: dot1q

Administrative private-vlan trunk normal VLANs: none

Administrative private-vlan trunk associations: none

Administrative private-vlan trunk mappings: none

Operational private-vlan: none

Trunking VLANs Enabled: ALL

Pruning VLANs Enabled: 2-1001

Capture Mode Disabled

Capture VLANs Allowed: ALL

Appliance trust: none

switch-1-#show vlan private-vlan type

Vlan Type

---- -----------------

100  normal

101  normal

102  normal

103  normal

switch-1-#show vlan

VLAN Name                             Status    Ports

---- -------------------------------- --------- -------------------------------

1    default                          active    Gi1/0, Gi1/1, Gi1/2, Gi1/3

                                                Gi2/0, Gi2/1, Gi2/2, Gi2/3

                                                Gi3/0, Gi3/1, Gi3/2, Gi3/3

100  VLAN100                          active

101  first_community                  active

102  second_community                 active

103  isolate_community                active

Primary Secondary Type              Ports

------- --------- ----------------- ------------------------------------------

100     101       non-operational   Gi0/0, Gi0/1

100     102       non-operational   Gi0/0, Gi0/2

100     103       non-operational   Gi0/0, Gi0/3

(In the type field you see non-operational, this is because I do not have an upgraded switch. you will see community, isolated, and pro port in the upgraded switch)

What is Administrative Distance? How to change AD value of OSPF, EIGRP, RIPv2 and BGP?

 

 

Administrative Distances

The administrative distance is used to rate the accuracy of routing protocol information received on a router from a neighbor router. An administrative distance is an integer value ranging from 0 to 255, where 0 means most trusted and 255 untrusted no traffic will be passed through this route or this route will never be installed in the routing table.

 

What will happen if our router receives two updates for the same remote network?

The first task our route will do is to check the administrative distance (AD). If one of the two updates has a lower AD than the other route.  our router will install a lower AD route in the routing table.

Now again, what will happen if both the advertise updates have the same AD for the same remote network?

In this case, our router will find the best path for the remote network by comparing routing protocol metrics like hop count or the bandwidth of the lines depending on the routing protocol. The lowest metric will win and our router will install the route in the routing table.

Now one more time again, what if both advertise updates (route) have the same AD, and the same metric which route a router will install in its routing table?

The answer is router will do load balances to the remote network.

 

The administrative distance default values

Route source (protocol)	Default Administrative distance (AD)
Connected interface	0
Static route	1
Enhanced Interior Gateway Routing Protocol (EIGRP) summary route	5
External Border Gateway Protocol (BGP)	20
Internal EIGRP	90
IGRP	100
Open Shortest Path First OSPF OSPF	110
Intermediate System-to-Intermediate System (IS-IS)	115
Routing Information Protocol (RIP)	120
Exterior Gateway Protocol (EGP)	140
On-Demand Routing (ODR)	160
External EIGRP	170
Internal BGP	200
Unknown*	255

 if you want to change the default administrative distance value yes you can change it, so let's configure the experiment here we are going to advertise the same remote network with 5 different protocols. let's see the router will install which route and then we will change the default AD and see the router action.

(If you are familiar with Internetworks blogs you know we come straight to the point and like LABS, I request you please visit our YouTube program and click here thank you) 

Topology: -

• configure the topology as per the diagram 
• assign the IP addresses to their ports as per the topology
• configure a static route between routers 1-2-7
• configure EIGRP routing between routers 1-3-7
• configure OSPF routing between routers 1-4-7 
• configure RIPv2 routing between routers 1-5-7
• configure IBGP routing between routers 1-6-7
• advertise directly connected network
• now you will see all the routers (R2, R3, R4, R5 and R6) advertising the same network 20.1.1.0 with different administrative distance
• now ping from PC-1 to PC-2 and see which path router-1 will choose in order to reach the 20.0.0.0 network.