L2 Threats
Security techniques usually operate at L3 and above — VPN, firewall, IPS, ... But if an attacker gets a foothold at L2, all higher layers are potentially at risk. In practice, L2 is often the weakest link: we blindly trust the local network, we have to connect to it anyway to be able to work, and we rarely think about who or what else is connected to it.
In an age of BYOD and freely available hacking tools, that's a problem.
Attack Overview
| Attack | Goal |
|---|---|
| MAC table flooding | Fill up a switch's MAC address table with false info |
| VLAN hopping | Gain access to other VLANs without a router |
| VLAN double tagging | Send a frame to another VLAN via a double tag |
| DHCP starvation | Exhaust the DHCP pool → DoS for clients |
| DHCP spoofing | A fake DHCP server → hands out wrong network settings |
| ARP spoofing/poisoning | Manipulate ARP tables → MITM |
| Address spoofing | Take over the MAC or IP address of another device |
| STP attack | Spoof the root bridge → manipulate the topology |
| CDP reconnaissance | Abuse CDP info for network information |
MAC Table Flooding
Switches have a fixed-size MAC address table. Once it's full, the switch floods incoming frames to all ports in the same VLAN — and an attacker can intercept all that traffic.
Attack:
1. The attacker sends a flood of frames with fake source MAC addresses (e.g. via macof)
2. The table fills up — legitimate entries get evicted
3. The switch starts behaving like a hub: all frames are flooded
4. The attacker intercepts traffic via Wireshark → reconnaissance, eavesdropping
A Catalyst switch holds up to 132,000 entries. macof generates 8,000 fake frames per second → the table fills up in ~20 seconds.
Mitigation: Port Security — limits the number of MAC addresses a port is allowed to learn.
VLAN Attacks
VLAN Hopping
An attack where traffic intended for one VLAN can be seen by another VLAN, without a router.
Abuses the fact that access ports are sometimes configured as trunks. The attacker makes their device behave like a switch (sends fake trunking signaling), after which the switch sets up a trunk. Through that trunk, the attacker can send and receive traffic on all VLANs.
Mitigation: - Disable trunking on all access ports - Disable auto-trunking, always configure manually - Use a dedicated native VLAN that only trunk ports use
VLAN Double Tagging
The attacker inserts a hidden VLAN tag into the payload of an already tagged frame.
- The outer tag = the switch's native VLAN ID
- The first switch strips the outer tag and forwards on native VLAN ports — without re-tagging
- The next switch sees the now-visible inner tag and forwards it to that target VLAN
Only works if the attacker is connected to a port in the same VLAN as the trunk's native VLAN.
Mitigation: same as VLAN hopping — dedicated native VLAN, trunking not automatic.
DHCP Attacks
DHCP itself is not an L2 protocol, but the mitigation does take place at L2.
DORA: Discover → Offer → Request → Acknowledge
DHCP Starvation
Goal: completely exhaust the DHCP pool → DoS for new clients.
The attacker continuously sends DHCP Discover messages with fake source MAC addresses (e.g. via the Gobbler tool). The DHCP server thinks these are real clients and reserves all IP addresses. New legitimate clients can no longer get an IP address.
Mitigation: Port Security
DHCP Spoofing
A rogue DHCP server appears on the network and hands out incorrect information:
| Incorrect info | Consequence |
|---|---|
| Wrong IP address | Client can't communicate |
| Wrong default gateway | All traffic redirected → MITM possible |
| Wrong DNS address | DNS in the attacker's hands → users redirected to malicious sites |
Mitigation: DHCP Snooping
ARP Attacks
How ARP works
To forward a frame to the next hop, a device needs the MAC address of that hop. ARP resolves this: a broadcast asks "who has IP x.x.x.x?" — the node with that IP replies with its MAC via a unicast ARP reply.
Gratuitous ARP
A node can spontaneously send a broadcast ARP reply without there having been a request (unsolicited ARP). Every node that hears this automatically stores the stated IP-MAC pair in its ARP cache.
The problem: there's no verification. Any host can claim to be the owner of any IP-MAC combination.
ARP Spoofing / Poisoning → MITM
- The attacker sends gratuitous ARPs to both victims
- To victim A: "B's IP belongs to the attacker's MAC"
- To victim B: "A's IP belongs to the attacker's MAC"
- Both victims now send their traffic to the attacker → MITM
- The attacker can read, modify or forward everything
Mitigation: DAI (Dynamic ARP Inspection)
Address Spoofing
An attacker takes over a MAC or IP address that's already in use. This causes a duplicate address problem and disrupts correct communication for the affected device.
Mitigation: IP Source Guard (IPSG)
STP Attacks
The attacker sends BPDUs with false topology information → STP recalculates the topology. By sending a BPDU with a very low priority, the attacker hopes to be elected as the root bridge → traffic then flows through their device.
Mitigation: enable BPDU Guard on all access ports.
CDP Reconnaissance
CDP (Cisco Discovery Protocol) automatically shares information about the device: model number, IOS version, IP addresses, port information, ... Useful for management, but also interesting for an attacker during their reconnaissance phase.
Mitigation: disable CDP on access ports and on ports facing untrusted devices or networks (e.g. WAN ports).