I came across these attacks, but every explanation I come across lacks clarity

Random Frame-Stress Attack:

A large number of packets is generated, randomly varying several fields within each packet and leaving only the source and destination addresses untouched. The aim is to see how the switch software copes with meaningless or unexpected values in packet fields.

What is meant by 'randomly varying several fields' and if successful, is the aim just to stop the switch from working?

Multicast Brute Force Attack is just as bad:

As with CAM overflow, the aim is to see if a switch receiving a large amount of layer 2 multicast traffic will “misbehave”. The switch should limit the traffic to its original VLAN, but if the switch does not handle this correctly, frames might leak into other VLANs, if routing connects them.

So, if multicast frames 'leak', so what? Is this just a denial of service for other VLANs?

Source can be found here: https://www.redscan.com/news/ten-top-threats-to-vlan-security/

  • 1
    "came across these attacks" - it might be useful to provide the context, i.e. the link or so where you've found this information. This context can be helpful in understand what is written and thus to give you a better answer. "randomly varying several fields" - I'm not sure what is unclear here. This is about randomly setting various parts of the packet to see how the switch reacts to these and thus find potential incorrect behavior which can be misused. Oct 29, 2022 at 13:54
  • The only source I have found for your "Random Frame Attack" explains what the aim is (in the very next sentence). And you have mis-quoted what the attack is.
    – schroeder
    Oct 29, 2022 at 14:13
  • 1
    As for "leaks", the problem is the "leak", not a DoS. As the explanation outlines for you, traffic should be contained in the VLAN. Traffic that is not meant for other VLANs should not go to other VLANs.
    – schroeder
    Oct 29, 2022 at 14:16
  • Steffen - what 'parts' can be randomised? Can you give me an example? Apologies if this is a silly question - really trying to get my head around it
    – Beginner
    Oct 30, 2022 at 16:37
  • @schroeder can I confirm that the attacker has compromised a VLAN (say VLAN2), commits a brute force attack against the switch . .. which will then leaks traffic - say from VLAN3 onto VLAN 2?
    – Beginner
    Oct 30, 2022 at 16:45


You must log in to answer this question.

Browse other questions tagged .