Internet Control Message Protocol

Discuss about the Internet Control Message Protocol.

 

 

A campus network refers to a proprietary LAN (local area network) or a set of LAN’s that are interconnected that serve bodies such as corporation, government agencies, or educational institutions such as universities. The campus is a set of buildings in close proximity to each other although the end users can be dispersed more widely (geographically) but using a single LAN but they are not scattered as wide as would be in a WAN (wide area network) (Rouse, 2016). Campus Networks can be a target of various attacks; this paper discusses some possible attacks and their solutions

This is an attack type where the IP (Internet protocol) broadcast addressing is exploited and the victim is flooded with ICMP (Internet Cntrol Message Protocol) ping (echo) replies sent from another network. Using a Smurf program, attackers cause the attacked network section to become inoperable; the attack depends on an intermediary to broadcast ICMP ping packets to hosts on the target subnet within a campus network. The Smurf program creates a legitimate network packet that appears to have originated from another address; it has an ICMP ping message addressed to all IP addresses in the campus network. On arrival at the target subnet, the ICMP ping request packet is converted into a Layer 2 broadcast and then sent to connected hosts (Barrett, 2010).

The attack only becomes possible if the device (router) in a layer 2 subnet has directed forwarding of broadcasts enabled, so disabling this will stop the flooding with ICMP ping replies.  Another solution is placing a box switch with the capability of DHCP snooping to discard invalid packets as a core switch within the campus network. An example is the Huawei S 6700 advanced switch (Barrett, 2010).

Cisco Discovery Protocol (CDP) Attacks

CDP is a commonly used tool by technicians to create a network documentation that is usually enabled by default in most switches. This can be attacked through a technique called CDP spoofing on Cisco routers, switches, or other network equipment y creating forged CDP packets impersonating other devices to compromise a campus network’s operation.  And this is incredibly easy to achieve; a hacker with Kali Linux can easily spoof the CDP and compromise a network just by starting the Yersinia program in Kali Linux and clicking attack; the switch will crsh and reboot in minutes, greatly disrupting the campus network (Vonnie, 2015).

This attack can be prevented/ mitigated by placing all switch ports that are not being used in a dummy VLAN (Virtual LAN) and enable admin down. Another approach entails disabling CDP on switches and swicthports that do not need it (CDP); for instance, access points that only have an IP phone or a computer; these do not need CDP to function. The third approach is to configure proper port security on ports that cannot be disabled; using the command

Where n is the number of MAC’s so a limit can be set to say 5; this will effectively limit the number of addresses and even if Yersinia launches a flood of addresses, the switch will essentially place the port on a state of secure shutdown, preventing network interruption. In this case, the access to a switchport is confined to a specified layer 2 MAC address and this will not permit the Kali box with Yersinia to launch a CDP attack (Heygele, 2014)

Conclusion

Attacks to campus networks can cause great harm; some of the common and potentially destructive attacks include Smurf attacks where ICMP ping packets are used to flood a victim. This can be mitigated by disabling directed forwarding of broadcasts. Another attack that can target a layer 2 device is CDP attacks that are incredibly easy to achieve; this is mitigated by  enabling switch port security

References

Barrett, D. (2010). CompTIA security+ SY0-201 practice questions exam cram: Exam SY0-201. [Indianapolis, Ind.], Pearson Education.

Heygele, R., 2014. Protect your network against CDP attacks! [online] Infra Blog. Available at: <https://heggel4.wordpress.com/2014/10/11/protect-your-network-against-cdp-attacks/> [Accessed 2 May 2017].

Rouse, M., 2016. What is campus network? - Definition from WhatIs.com. [online] Tech target. Available at: <https://searchsdn.techtarget.com/definition/campus-network> [Accessed 29 Apr. 2017].

Vonnie, B., 2015. Destroying a Cisco Switch with CDP Flooding. [online] fixedByVonnie. Available at: <https://www.fixedbyvonnie.com/2015/06/destroying-a-cisco-switch-with-cdp-flooding/#.WQgR_DQlHR0> [Accessed 2 May 2017].