CDP - LLDP Attack

It is a multicast protocol used to learn neighborhood relationships and device data that supports some CDP/LLDP protocols. With CDP/LLDP spoofing, it is aimed to lock switch resources by sending fake CDP/LLDP packets and filling CDP/LLDP tables. At the same time, by obtaining important information such as switch ip - mac addresses, LLDP attacks can be made and the attacker can show himself as a switch by writing himself in the neigboard table and ensure that the traffic passes through him.

How to do CDP / LLDP Attack?

The neighbors table before the CDP flooding attack is as follows.

Open

Attacker locks the switch resources by filling the CDP neigbors table by making a CDP flooding attack from the port it is connected to.

Open

CDP Snarf attack is performed to obtain information about the switch. By sending LLDP packets with the obtained mac address, the attacker can add himself to the LLDP neigbors table.

Open

Open

Open

How to prevent CDP / LLDP Attack?

CDP and LLDP can be turned off completely on the Switch. For this, it is necessary to turn off CDP and LLDP in global mode. For this, go to the Hardenin section in Sechard and turn off "Set no CDP run" by Enabling it.

Open

CDP and LLDP can be turned off as a service.

Open

Open

Another option is to disable CDP and LLDP not in global mode but under interfaces. It makes sense to prevent these protocols from running on the port to which the end user will be connected.

CDP is disable by selecting interfaces on the Security page on Sechard.

Open

Open