2

I was having a discussion with a friend of mine in IS industry and he insisted that setting static MAC addresses (i.e. port security) on devices were a effective way to block MAC spoofing. I found this hard to believe as it does not prevent an attacker from sniffing and finding the MAC addresses of legitimate traffic and then spoofing it.

Question then is, would static MAC address on switches and routers help prevent attackers gaining access through MAC spoofing and if so, how?

3

Assigning a specific MAC address to a specific port guarantees that only a device with this MAC address will get connectivity on this port. This policy is usually done in combination with monitoring the port for policy violations to detect if somebody plugs in a device with another MAC address.

Thus an attacker has to use passive sniffing techniques to get the MAC for the device used on this specific port and then replace the device with its own. But with a simple replacement the other device will no longer work. Since this might get detected the attacker needs to employ a more intelligent solutions. At the end the knowledge and care needed by the attacker to be stealth is much higher than without static MAC assignment and the chance to get detected is higher too. This makes static MAC assigning not a 100% secure solution against MAC spoofing but makes spoofing considerable harder which is in most cases enough.

  • When you state that it is used in combination with monitoring for policy violations, do you mean something like a NAC used in combination with the port security. – user92592 Nov 28 '15 at 11:41
  • Also I know MAC at layer 2 is not authenticated, i.e. a switch receives a packet and checks the MAC address with its lookup table to see the associated IP address, if it is different then it will update its table to reflect the change and pass any traffic destined for that MAC to the specified IP. Would there be a log in the switch that would reflect all these MAC to IP address changes and if so, could that be used as a detection mechanism, i.e. a specific MAC is having its associated IP address changed regularly within a 1 hour time frame – user92592 Nov 28 '15 at 11:42
  • @user92592: A classical switch is layer 2 and has no idea of IP addresses. IP addresses are at layer 3 and relationship between IP and MAC is done with ARP requests. You can employ solutions which check for problems at this layer (fake ARP replies, DHCP spoofing....) but this layer 3 functionality is not available in the classical (layer 2) switches. – Steffen Ullrich Nov 28 '15 at 12:00
  • @user92592: With monitoring I mean SNMP traps which are sent when violations occur or other kind of reactions, see also nsa.gov/ia/_files/factsheets/…. – Steffen Ullrich Nov 28 '15 at 12:05
  • Thanks allot @Steffen Ullrich, good explanation, that helps improve understanding allot – user92592 Nov 28 '15 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.