5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy

5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy

The Data Link Layer (OSI Layer 2) provides local addressing, frame delivery, media access control, and physical loop avoidance across switched broadcast domains. Because Layer 2 protocols were historically engineered under the assumption that all physical connections within a building originate from trusted endpoints, they almost completely lack native cryptographic authentication. Consequently, compromised access ports present severe vulnerability risks. A CREST Practitioner Security Analyst must understand the mechanics of Layer 2 protocols to identify exploitation paths and recommend switch-hardening countermeasures.

---

1. Address Resolution Protocol (ARP) & Cache Poisoning

Address Resolution Protocol (ARP), defined in RFC 826, resolves known 32-bit Network Layer (IPv4) addresses to dynamic 48-bit Data Link Layer (MAC) hardware addresses within a local broadcast domain.

Standard ARP Exchange:
Host A (192.168.1.10) ────────► Broadcast: "Who has 192.168.1.1? Tell 192.168.1.10" ────────► FF:FF:FF:FF:FF:FF
Host A (192.168.1.10) ◄──────── Unicast:   "192.168.1.1 is at 00:50:56:FE:ED:01"    ◄──────── Router (192.168.1.1)

ARP Message Flow & Gratuitous ARP

1. ARP Request: Transmitted as an Ethernet broadcast to destination MAC FF:FF:FF:FF:FF:FF (Opcode 1). Every host in the broadcast domain receives and inspects the frame.
2. ARP Reply: The host claiming the requested IP address responds with an Ethernet unicast frame directed specifically to the requester's MAC address (Opcode 2).
3. Gratuitous ARP (GARP): An unsolicited broadcast ARP request or reply where both the Source IP and Target IP are identical to the sending host's IP address. Legitimate use cases include:
   • IP Address Conflict Detection: Emitted during interface initialization; if another host replies, an IP collision exists.
   • Clustering / Failover: High-availability firewalls or routers (e.g., CARP, HSRP) emit a GARP following a failover event, forcing upstream switches to update their MAC forwarding tables and client hosts to update their ARP caches to point to the backup node's physical port.
   • NIC Teaming: Updating switch port MAC tables following link bonding transitions.

+-----------------------------------------------------------------------------------+
|                        BIDIRECTIONAL ARP POISONING (MitM)                         |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|      +---------------------------------------------------------------------+      |
|      |                       VICTIM HOST (192.168.1.50)                    |      |
|      |               Target ARP Cache: 192.168.1.1 -> AA:AA:AA:AA:AA:AA    |      |
|      +---------------------------------------------------------------------+      |
|                           ^                             |                         |
|    Spoofed ARP:           |                             | Outbound Data Traffic   |
|    "192.168.1.1 is at     |                             | (Captured by Attacker)  |
|     AA:AA:AA:AA:AA:AA"    |                             v                         |
|      +---------------------------------------------------------------------+      |
|      |                      ATTACKER (AA:AA:AA:AA:AA:AA)                   |      |
|      |                     Forwards Packets via IP Forwarding              |      |
|      +---------------------------------------------------------------------+      |
|                           ^                             |                         |
|    Inbound Return Traffic |                             | Spoofed ARP:            |
|    (Captured by Attacker) |                             | "192.168.1.50 is at     |
|                           |                             |  AA:AA:AA:AA:AA:AA"     |
|                           |                             v                         |
|      +---------------------------------------------------------------------+      |
|      |                     DEFAULT GATEWAY (192.168.1.1)                   |      |
|      |               Target ARP Cache: 192.168.1.50 -> AA:AA:AA:AA:AA:AA   |      |
|      +---------------------------------------------------------------------+      |
+-----------------------------------------------------------------------------------+

The Vulnerability: Stateless Caching & Poisoning Attacks

ARP is inherently stateless and unauthenticated. Operating systems do not track outstanding ARP requests; if an unsolicited ARP reply arrives, the receiving host updates its local ARP table, overwriting the existing MAC address entry for that IP. In an ARP Poisoning (ARP Spoofing) attack:

• The attacker transmits continuous, unsolicited ARP replies to the target victim host claiming that the IP of the Default Gateway is bound to the Attacker's MAC.
• Simultaneously, the attacker transmits unsolicited ARP replies to the Default Gateway claiming that the IP of the Victim Host is bound to the Attacker's MAC.
• With bidirectional poisoning established, all traffic between the victim and external networks flows directly through the attacker's network interface.
• By enabling packet forwarding (sysctl -w net.ipv4.ip_forward=1), the attacker silently inspects, logs, modifies, or drops traffic in real time using tools such as arpspoof, bettercap, or Ettercap.

Defenses: Dynamic ARP Inspection (DAI)

To mitigate ARP spoofing, enterprise switches implement Dynamic ARP Inspection (DAI). DAI classifies switch access ports as untrusted. When an ARP frame arrives on an untrusted port, the switch intercepts it and validates the sender IP and MAC binding against the DHCP Snooping binding database (or pre-configured static ARP Access Control Lists). If the mapping does not exist or does not match, the switch drops the invalid ARP packet and increments an attack counter.

---

2. Cisco Discovery Protocol (CDP) & Link Layer Discovery Protocol (LLDP)

Network discovery protocols operate at Layer 2 to automatically map physical topology, facilitate device auto-configuration, and exchange operational telemetry between directly connected neighbors.

Telemetry Disclosed by CDP/LLDP

Discovery protocol frames are transmitted periodically as unencrypted, unauthenticated Layer 2 multicasts. Inspecting a single captured CDP frame reveals:

• Device Identifier: The fully qualified hostname of the adjacent device.
• Software / Firmware Version: Exact Cisco IOS release string (e.g., Cisco IOS Software, C2960 Software (C2960-LANBASEK9-M), Version 15.0(2)SE4).
• Hardware Platform: Specific device model (e.g., cisco WS-C2960-24TT-L).
• Interface / Port Identifiers: Local egress port (GigabitEthernet0/1) and remote connected port (FastEthernet0/24).
• VLAN Membership & Native VLAN: Configured native VLAN (vital for diagnosing VLAN hopping exposure).
• Layer 3 Management Addresses: Primary IPv4/IPv6 address assigned to the device's management interface.
• Duplex, Power over Ethernet (PoE), and VTP Domain: Operational hardware parameters.

Attack Vectors & Hardening

• Passive Information Disclosure: An attacker simply connects a laptop running Wireshark to any active wall jack in an office. Without sending a single probe packet, the attacker captures periodic CDP/LLDP frames, obtaining the switch model, exact IOS patch level (identifying unpatched CVEs), native VLAN, and management IP.
• CDP Flooding / DoS: Attackers use tools like yersinia to flood thousands of forged CDP packets with randomized device IDs, exhausting switch memory (CAM/RAM) and triggering device crashes.
• Hardening Guidance: Disable CDP/LLDP globally on devices where discovery is unnecessary (no cdp run / no lldp run), and strictly disable it on all untrusted access ports connecting to end-user workstations:

Switch(config)# interface range FastEthernet 0/1 - 24
Switch(config-if-range)# no cdp enable
Switch(config-if-range)# no lldp transmit
Switch(config-if-range)# no lldp receive

---

3. Spanning Tree Protocol (STP): Attacks & Countermeasures

Ethernet networks lack a Time to Live (TTL) field in Layer 2 frame headers. If redundant physical links exist between switches without loop prevention, broadcast frames (such as ARP requests) circulate infinitely, generating catastrophic broadcast storms that consume 100% of link bandwidth and crash switch control planes within seconds. Spanning Tree Protocol (STP, IEEE 802.1D), along with Rapid STP (RSTP, 802.1w) and Multiple STP (MSTP, 802.1s), dynamically breaks physical loops by placing redundant switch ports into a blocking state.

+-----------------------------------------------------------------------------------+
|                             STP ROOT BRIDGE ELECTION                              |
+-----------------------------------------------------------------------------------+
|  Bridge ID (8 Bytes) = 2-Byte Bridge Priority + 6-Byte Switch Base MAC Address   |
|                                                                                   |
|  Standard Default Priority:  32768 (Plus System ID Extension = VLAN ID)           |
|  Lowest Bridge ID Wins:      Priority 0 beats all other switches                 |
+-----------------------------------------------------------------------------------+

Root Bridge Election Mechanics

Switches exchange Bridge Protocol Data Units (BPDUs) every 2 seconds to elect a central Root Bridge for the Spanning Tree topology:

• Bridge ID (BID): An 8-byte value composed of a 2-byte Bridge Priority (default 32768) and the switch's 6-byte base MAC address.
• Election Rule: The switch possessing the lowest Bridge ID is elected as the Root Bridge. If priorities are equal, the switch with the numerically lowest MAC address wins.
• Once elected, the Root Bridge acts as the reference point for calculating root ports, designated ports, and alternate (blocking) ports across the entire Layer 2 fabric.

STP Rogue Root Bridge Attack

An attacker connected to a standard access port uses software like yersinia or custom Python Scapy scripts to inject crafted Configuration BPDUs into the network:

• The attacker advertises a Bridge Priority of 0 (0x0000) and a spoofed MAC address of 00:00:00:00:00:01.
• Because 0 is lower than the legitimate core switch priority (typically 4096, 8192, or default 32768), the entire switched network recalculates its spanning tree.
• The attacker's device is elected as the new Root Bridge.
• Switches reconfigure their designated paths, forcing inter-switch trunk traffic to traverse the attacker's physical link, enabling comprehensive Man-in-the-Middle traffic capture or triggering widespread network disruption.

STP Defensive Countermeasures

Modern switch security architectures employ three essential protective features:

1. BPDU Guard: Configured on access ports where end-user hosts connect (typically paired with PortFast). If a BPDU frame is detected on a BPDU Guard-enabled port, the switch immediately shuts down the port and transitions it into an err-disabled state, completely thwarting rogue BPDU injection.
2. Root Guard: Configured on downstream designated ports connecting to secondary switches. Root Guard enforces the administrative placement of the Root Bridge. If superior BPDUs (advertising a lower BID) arrive on a Root Guard port, the switch places the port into a root-inconsistent state, blocking traffic until the rogue BPDUs stop.
3. Loop Guard: Prevents alternate or root ports from becoming designated ports due to unidirectional link failures, preventing accidental forwarding loops.

---

4. VLAN Trunking Protocol (VTP) Attacks

VLAN Trunking Protocol (VTP) is a proprietary Cisco Layer 2 messaging protocol that synchronizes VLAN definitions (VLAN IDs, names, MTU sizes) across switches sharing a common VTP domain over 802.1Q trunk links.

VTP Operational Modes

• Server Mode (Default): Can create, modify, and delete VLANs. Generates VTP advertisements and increments the Configuration Revision Number by 1 for each change.
• Client Mode: Cannot modify VLANs locally. Listens to VTP advertisements from servers, synchronizes its local VLAN database, and forwards advertisements across trunks.
• Transparent Mode: Does not participate in dynamic VTP domain synchronization; maintains an independent local VLAN database in NVRAM, but forwards received VTP advertisements to downstream switches.

The VTP Wiping Attack (Revision Number Hijacking)

When a VTP switch receives an advertisement with a matching VTP domain name and password, it evaluates the Configuration Revision Number:

• If the received revision number is higher than its current local revision number, the switch immediately overwrites its entire VLAN database with the contents of the received advertisement.
• Exploitation Scenario: An attacker (or an engineer reusing a switch from a test lab) connects a switch to an enterprise trunk port. If the rogue switch shares the same VTP domain name and has a higher revision number (e.g., revision 50) containing only the default VLAN 1, all production switches in the domain instantly wipe their local VLAN databases (deleting VLANs 10, 20, 30, etc.).
• Impact: Switch access ports assigned to deleted VLANs become inactive, blackholing traffic and causing a catastrophic, network-wide denial of service.
• Mitigation: Set switches to VTP Transparent mode, configure strong VTP domain passwords (MD5 hash verification), or implement VTP Version 3, which requires primary server authorization.

---

5. First-Hop Redundancy Protocols (FHRP): HSRP & VRRP

Endpoints rely on a statically configured default gateway to reach external subnets. If the physical router hosting that gateway IP fails, endpoints lose all off-subnet connectivity. First-Hop Redundancy Protocols (FHRP) create a redundant, virtual default gateway shared between two or more physical routers.

+-----------------------------------------------------------------------------------+
|                                FHRP COMPARISON OVERVIEW                           |
+-----------------------------------------------------------------------------------+
| Feature / Attribute     | HSRP (RFC 2281 / Cisco)             | VRRP (RFC 5798 / IETF Standard)   |
+-------------------------+-------------------------------------+-----------------------------------+
| Roles                   | Active Router / Standby Router      | Master Router / Backup Routers    |
| Protocol Wrapper        | UDP Port 1985                       | IP Protocol 112 (Raw IP, no L4)   |
| Multicast Address       | v1: 224.0.0.2 / v2: 224.0.0.102     | 224.0.0.18 (All-VRRP-Routers)     |
| Virtual MAC Format      | v1: 00:00:0c:07:ac:XX               | 00:00:5E:00:01:XX                 |
|                         | v2: 00:00:0c:9f:fX:XX               | (XX = VRRP Virtual Router ID hex) |
| Default Priority        | 100 (Range: 0 - 255)                | 100 (Range: 1 - 254; 255 = Owner) |
+-----------------------------------------------------------------------------------+

FHRP Operational Flow:
[ Active / Master Router ] <=== Hello Multicast ===> [ Standby / Backup Router ]
        │ (Priority 110)                                     │ (Priority 100)
        │                                                    │
        └─── Virtual IP Gateway: 192.168.1.254 (Virtual MAC) ┘
                                 ▲
                                 │ Outbound Traffic
                       [ LAN Switch / Hosts ]

HSRP (Hot Standby Router Protocol)

HSRP is a Cisco proprietary protocol (RFC 2281):

• Election: The router configured with the highest priority (default 100, max 255) becomes the Active Router and forwards traffic sent to the virtual IP. The second router remains in Standby.
• Virtual MAC Structure: In HSRPv1, the virtual MAC address is formatted as 00:00:0c:07:ac:XX, where XX is the hex representation of the HSRP Group Number (e.g., Group 10 maps to 00:00:0c:07:ac:0a).
• Transport: Routers exchange periodic Hello packets (default every 3 seconds) over UDP port 1985 addressed to multicast 224.0.0.2 (v1) or 224.0.0.102 (v2).

VRRP (Virtual Router Redundancy Protocol)

VRRP is an open IETF standard defined in RFC 3768 and RFC 5798:

• Election: The elected forwarding router is termed the Master Router; other redundant nodes are Backup Routers. Priority 255 is reserved for the router that owns the physical IP matching the virtual gateway IP.
• Transport: VRRP does not use a Layer 4 UDP or TCP header; it runs directly over IP using IP Protocol 112 addressed to multicast 224.0.0.18.
• Virtual MAC Structure: Formatted as 00:00:5E:00:01:XX, where XX is the Virtual Router Identifier (VRID) in hexadecimal.

FHRP Hijacking Attack

If FHRP groups are configured without cryptographic message authentication (or with default cleartext keys):

• An attacker on the local subnet injects forged HSRP Hello packets or VRRP Advertisement packets with a priority of 255 and preemption enabled.
• The legitimate Active/Master router demotes itself to Standby/Backup.
• Upstream and client traffic targeting the default gateway's virtual IP redirects immediately to the attacker's interface, establishing a full Man-in-the-Middle position across the entire subnet.
• Mitigation: Implement MD5/SHA-256 HMAC authentication for FHRP packets and restrict access switch ports using Port Security and DHCP Snooping.