6

I live at a student dorm, where we are connected to a student network. The administrators of this network have forgotten to disable STP broadcast on non-infrastructure ports.

Periodically, I lose my network connection, and I decided to see if the STP configuration might be the issue.

This the normal packet I receive every second:

4   0.179081    Alcatel-_c3:a8:91   Spanning-tree-(for-bridges)_00  STP Conf. Root = 32768/0/00:d0:95:88:dc:d6  Cost = 4  Port = 0x722f

When the network outage occurred, I checked my wireshark logs, and the following appeared:

3   0.597039    Alcatel-_c3:a8:91   Spanning-tree-(for-bridges)_00  STP Conf. Root = 32768/0/00:d0:95:c3:a8:68  Cost = 0  Port = 0x722f
6   1.577752    04:4b:80:80:80:03   Spanning-tree-(for-bridges)_00  STP Conf. TC + Root = 32768/0/06:4b:80:80:80:03  Cost = 0  Port = 0x8000
8   2.599098    Alcatel-_c3:a8:91   Spanning-tree-(for-bridges)_00  STP Conf. Root = 32768/0/00:d0:95:c3:a8:68  Cost = 0  Port = 0x722f
9   2.599133    04:4b:80:80:80:03   Spanning-tree-(for-bridges)_00  STP Topology Change Notification

While network is "down", the following STP packet is received every second:

1619    38.636743   Alcatel-_c3:a8:91   Spanning-tree-(for-bridges)_00  STP Conf. Root = 32768/0/00:d0:95:c3:a8:68  Cost = 0  Port = 0x722f

And when the network is working properly again, I receive the following:

2932    584.778568  Alcatel-_c3:a8:91   Spanning-tree-(for-bridges)_00  STP Conf. Root = 32768/0/00:d0:95:88:dc:d6  Cost = 4  Port = 0x722f

By odd luck, I decided to google the hardware address 04:4b:80:80:80:03, as it seemed a bit odd. It turns out there are many people who have issues with nVidia chipsets who set this NIC address to default...

My thought about this is that some desktop machine is experimenting with STP attacks. This is the first STP network I've encountered, so I'm not sure what I'm seeing here, and hope someone with more insight than me can help me understand what is happening.

Edit:

Recently, the packets have now changed:

58  114.145230  Alcatel-_c3:a8:91   Spanning-tree-(for-bridges)_00  STP Conf. Root = 61440/4095/ff:ff:ff:ff:ff:ff  Cost = 4  Port = 0x722f

The Root Bridge System ID is ff:ff:ff:ff:ff:ff. This is while I have no network outage. I've tried to find documentation for what purpose this broadcast hw addr is announced as the root bridge, but no luck...

Improve this question

2 Answers 2

Reset to default
3
+50

The classical spanning tree protocol may take up to 30 seconds to process a topology change. During this state, no non topology packets may be forwarded. Are the outages longer than 30 seconds?

Sending STP-notification to all ports may help if someone connects an STP enabled switch twice. Accepting them from any port is problematic because of the DoS vulnerability of the STP that you are experiencing. And it might make arp cache poisoning easier.

Normal computers may act as a bridge because of virtual machines, to allow the guest full network access. If I remember correctly, VMware does send STP notifications by default.

You should talk to the people responsible to operate the student network. They may be able to change the configuration to make it more stable (filter sources, migrate to one of the successors of STP). And they will be able to isolate the owner of that MAC address, at least the switch port it is connected to.

Improve this answer
1
  • The network outages I experience lasts for about 30 seconds.
    – Dog eat cat world
    Jul 14, 2011 at 0:21
2

I'm going with someone is plugging in a switch that tries to become the root bridge. Not necessarily mitm. Happens all the time in poorly managed switched networks.

Improve this answer
5
  • 1
    So, what you are saying is that someone might just have hooked up a switch with STP capabilities? But the MAC address tells its a nvidia chipset for desktop usage...
    – Dog eat cat world
    Jul 19, 2011 at 18:58
  • Switch with STP capabilities yes. To be sure the root bridge being layer 2 broadcast is retarded. It's NOT an nvidia card unless they made some serious oversight. More likely DoS than a mitm. Or a switch that tries to become the root bridge by forging the highest possible MAC...seems like lowest was desirable, but who knows about corner case implementations.
    – RobotHumans
    Jul 19, 2011 at 19:18
  • 04:4b:80:80:80:03 is neither the smallest nor the highest possible mac address. It is however the same MAC address caused by this serious bug in the nvidia chipset. If it desired to become the root bridge, it should have picked a lower bridge-id instead of the default 32768. I still believe the most likely reason is not any kind of attack but just a virtual machine setup.
    – Hendrik Brummermann
    Jul 19, 2011 at 19:47
  • I looked at this: The Root Bridge System ID is ff:ff:ff:ff:ff:ff.
    – RobotHumans
    Jul 19, 2011 at 21:29
  • To prevent someone injecting STP packets into your network you normally configure your front-end (user) ports to shut down when they see incoming BPDUs. (Different vendors use different names for the feature.)
    – Marki
    Mar 13, 2016 at 12:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .