Question

- Network security

QUESTION 17 We assume that a LAN network includes 7 hosts (A, B, C, D, E. Fand G) which are connected by a switch. The contents of the switch's CAM table is as follows: (Port 1. Host A) - (Port 2. Host B) - (Port 3. Host - Port 4, Host D) - Port S. Hosta-Port 6, Host F) - (Port 7. HostG), Also, we assume that there is/are one or many host(s) that has/have sent fake packets to corrupt the switch's CAM table. After this attack, the content of the CAM table became corrupted, as follow. (Port 2. Host A) - (Port 2. Host B) - (Port 3. Host C) - (Port 3, Host F) - (Port 4. Host D) - (Port 4, Host G) - (Port 5. Host E). Select the host(s) that sent the fake packets to corrupt the switch's CAM table? Host A Host B Host Host D Host E Host F Host G

Answer 1

Question 17.

CAM table Attack:

Please like.

O X CAM TABLE: LAN's switches maintain a table called the CAM table, and maps individual MAC addresses on the network to the physical ports on the switch. This allows the switch to direct data out of the physical port where the recipient is located, as opposed to indiscriminately broadcasting the data out of all ports as a hub does. The advantage of this method is that data is bridged exclusively to the network segment containing the computer that the data is specifically destined for. Figure 1 shows an example of entries in the CAM table of a switch. Four hosts are connected to the switch. For example, the first host (whose MAC address is 00:0F:1F:CO:EB:49) is connected to Port #1 (Interface: FastEthernet0/1) on the switch. When the switch receives a packet from a host, it extracts first the destination MAC address from the header of the Ethernet frame. Using this MAC address, the switch gets the corresponding port number from the CAM table. Then, the packet is sent only to the host connected to that port. Attack Description This attack intends to corrupt the entries in the switch's CAM table, so that the network traffic will be redirected. That is, a malicious host (connected to Port #a in a switch), sends a fake packet, with the source MAC address in the packet's Ethernet header set to the MAC address of a target host (connected to Port #b). The destination MAC address in the packet's Ethernet header can be any ad- dress. Once the switch receives the packet, it updates its CAM table. Therefore, the CAM table's entry for that target host's MAC ad- dress will be corrupted. Hence, the target host will be considered as a host connected to Port #a. Any packet sent to the target host (destination MAC address in the packet's Ethernet header is equal to the target host's MAC address) will be forwarded to Port #a: that is, to the malicious host. As example of CAM table poisoning attack. Figure 1 shows that in the CAM table of a switch, there are four hosts connected to the switch. Host #1, the malicious host, attacks the switch's CAM table using 3 fake packets. The three packets are almost the same, but they have different source MAC addresses in the Ethernet headers Activate Windows Go to PC settings to activate Windows.

Once a packet is sent to one of these three hosts (Host#2. Host#3 and Host#4), the switch will forward it to Port#1: that is, to Host#1. This situation may create a Dos situation, since the switch is not forwarding the packets, issued from these three hosts, to their destina- - Managed Switch Port Mapping Tool 1.30: Switch File Edit Connection View Accessibility Help ?? Interface Description Interface Type FastEthernet0/1 ethernetCsmacd(6) FastEthernet0/2 ethernetCsmacd(6) FastEthernet0/3 ethernetCsmacd(6) FastEthernet0/4 ethernet Csmacd(6) Switch Switch data gathering complete. Press F1 for help. Operational Status Speed MAC Address Up 100 Mbps 00:0F:1F:CO.EB:49 Up 100 Mbps 00:08:74:04:BC:44 Up 100 Mbps 00:08:74:05:AD:20 Up 100 Mbps 00:03:0D:38 79:57 tions. Figure (1): Contents of a CAM Table Activate Windows Go to PC settings to activate Windows.

OX - Managed Switch Port Mapping Tool 1.30: Switch File Edit Connection View Accessibility Help HÉHO .?R? Interface Description Interface Type Operational Status FastEthernet0/1 ethernetCsmacd(6) Up Speed MAC Address 100 Mbps 00:03:0D:38:79:57 00:08:74:04:BC:44 00:08:74:05:AD:20 00:0F:1F:CO:EB:49 100 Mbps 100 Mbps 100 Mbps FastEthernet0/2 ethernetCsmacd(6) FastEthernet0/3 ethernetCsmacd(6) FastEthernet0/4 ethernetCsmacd[6] Switch Switch data gathering complete. Press F1 for help. Up Up Up Figure 2: The content of the CAM table after the CAM table poisoning attack In our problem after attacking, the Hosts which send fake packets are.. Host B:- Actual Host of Port 2 is Host B only. But, after attacking Port 2 has Host A and Host B, so Host B sends fake packets to switch Host A. Similarly, Host C:- Actual Host of Port 3 is Host C only. But, after attacking Port 3 has Host C and Host F, so Host C sends fake packets to switch Host F. Host D:- Actual Host of Port 4 is Host D only. But, after attacking Port 4 has Host D and Host G, so Host D sends fake packets to switch Host G Activate Windows Go to PC settings to activate Windows. End of document I