¾ Dhcp Cheating Attack | TP-Link TL-SG2008 instruction

packet and broadcast the DHCP-REQUEST packet which includes the assigned IP address of the DHCP-OFFER packet.

（4） DHCP-ACK Stage: Since the DHCP-REQUEST packet is broadcasted, all DHCP servers on the network segment can receive it. However, only the requested server processes the request. If the DHCP server acknowledges assigning this IP address to the client, it will send the DHCP-ACK packet back to the client. Otherwise, the Server will send the DHCP-NAK packet to refuse assigning this IP address to the client.

¾DHCP Cheating Attack

During the working process of DHCP, generally there is no authentication mechanism between Server and Client. If there are several DHCP servers in the network, network confusion and security problem will happen. The common cases incurring the illegal DHCP servers are the following two:

（1） It’s common that the illegal DHCP server is manually configured by the user by mistake.

（2） Hacker exhausted the IP addresses of the normal DHCP server and then pretended to be a legal DHCP server to assign the IP addresses and the other parameters to Clients. For example, hacker used the pretended DHCP server to assign a modified DNS server address to users so as to induce the users to the evil financial website or electronic trading website and cheat the users of their accounts and passwords. The following figure illustrates the DHCP Cheating Attack implementation procedure.

Figure 5-19 DHCP Cheating Attack Implementation Procedure

DHCP Filtering feature allows only the trusted ports to forward DHCP packets and thereby ensures that users get proper IP addresses. DHCP Filtering is to monitor the process of hosts obtaining the IP addresses from DHCP servers, and record the IP address, MAC address, VLAN and the connected Port number of the Host for automatic binding. DHCP Filtering feature prevents the network from the DHCP Server Cheating Attack by discarding the DHCP packets on the distrusted port, so as to enhance the network security.

Choose the menu Switching → DHCP Filtering to load the following page.

49

Image 56

TP-Link TL-SG2008 manual ¾ Dhcp Cheating Attack, Dhcp Cheating Attack Implementation Procedure

Contents

TL-SG2008 REV1.0.0 1910010984 Copyright & Trademarks FCC Statement Safety Information Contents Loopback Detection 100 Rmon Package Contents About this Guide Intended ReadersConventions Overview of This Guide Chapter Introduction System Appendix a Specifications Overview of the Switch Main FeaturesIntroduction Appearance Description Rear Panel ¾ LEDs Name Status Indication Configuration Login to the SwitchLogin Return to Contents System System InfoSystem Summary ¾ Port Status Device Description ¾ Port InfoStatus Displays the connection status of the port ¾ Bandwidth Utilization ¾ Time Info System Time¾ Device Description Daylight Saving Time System IP System IP Following entries are displayed on this screen User Table ¾ IP ConfigUser Management User Config Password Type in a password for users’ login¾ User Info User Status Config Restore Confirm Password Password Display ModeUser ID, Name, Access Level and status Operation System Tools ¾ Config Backup Config BackupFirmware Upgrade System Reboot System Reset Access Security Access Control SSL Config IP Address & MaskMAC Address Port ¾ Global Config ¾ Certificate Download¾ Key Download Key File SSH Config Select Enable/Disable SSH function ¾ Network Requirements ¾ Configuration ProcedureDownload Application Example 2 for SSH Page Page Return to Contents Port SwitchingPort Config Port Mirror GroupMirroring Mode Egress NumberIngress Port Security ¾ Port Security Port Isolation Port Isolation ¾ Port Isolation Config Loopback Detection¾ Port Isolation List Forward Portlist Display the forwardlist Operation Mode LAG LAG Table ¾ LAG Table Member Static LAGGroup Number Lacp Config LAG will delete this LAG Port Priority ¾ Lacp ConfigAdmin Key Traffic Monitor Traffic SummaryPackets Rx Packets Tx Traffic Statistics Refresh Rate¾ Statistics Received MAC Address Bound MAC addressWay Port Address Table ¾ Search Option MAC Address Displays the MAC address learned by the switch Static Address¾ Address Table Displays the corresponding Vlan ID of the MAC address Dynamic Address ¾ Static Address Table Bind ¾ Aging Config¾ Dynamic Address Table Filtering Address ¾ Create Filtering Address ¾ Dhcp Working Principle Dhcp Filtering¾ Filtering Address Table 17 Network diagram of Dhcp 19 Dhcp Cheating Attack Implementation Procedure ¾ Dhcp Cheating Attack ¾ Trusted Port ¾ Dhcp FilteringDhcp Filtering Vlan 802.1Q Vlan ¾ Link Types of ports Vlan Config ¾ Pvid Give a name to the Vlan for identification NameUntagged Ports Tagged Ports ¾ Network Diagram Application Example for 802.1Q VlanUntagged Tagged Step Operation Description Required. On VLAN→802.1Q VLAN→VLAN Config page, configureRequired. On VLAN→802.1Q VLAN→VLAN Config page, create a Spanning Tree ¾ STP Elements ¾ STP Generation ¾ STP Timers¾ Bpdu Comparing Principle in STP mode Step Operation Tips ： ¾ Rstp Elements ¾ Mstp Elements ¾ Port States ¾ Port Roles STP Config STP Config Forward Delay VersionHello Time Max Age Port Config STP Summary Priority ExtPathIntPath Edge Port Region Config Instance Config¾ Region Config Mstp Instance ¾ Instance Table InstanceClear ¾ VLAN-Instance Mapping Path Cost Instance Port ConfigInstance ID STP Security Port Protect ¾ Root Protect ¾ TC Protect¾ Bpdu Protect ¾ Bpdu Filter TC Protect Application Example for STP Function 11 TC Protect On Spanning Tree→STP Config→STP Config On Spanning Tree→MSTP Instance→RegionOn Spanning Tree→MSTP Instance→Instance Operation Description On Spanning Tree→STP Config→Port Config ¾ Suggestion for Configuration Multicast ¾ Multicast Overview ¾ Multicast Address ¾ Multicast Address Table Igmp Snooping Multicast IP Port¾ Igmp Snooping ¾ Igmp Snooping Process Snooping Config ¾ Igmp Snooping Fundamentals ¾ Igmp Snooping Status Description Displays Igmp Snooping status Member Igmp Snooping Fast Leave Multicast Vlan ¾ Multicast Vlan Multicast→IGMP Snooping→Multicast Vlan On the Multicast→IGMP Snooping→Snooping ConfigVlan Snooping→Port Config Snooping→Snooping ConfigMulticast IP Multicast IP Table Static Multicast IP ¾ Static Multicast IP Table Multicast Filter¾ Create Static Multicast IP-Range Port Filter ¾ Port Filter Config Action ModeFilter Bound IP-Range ID Port Displays the port number of the switch Query Packet Packet StatisticsMulticast→Multicast Filter→IP-Range Multicast→Multicast Filter→Port Filter Return to Contents ¾ QoS ¾ Priority ModeQoS ¾ Schedule Mode 802.1Q frame SP-Mode ¾ Port Priority Config DiffServPort Priority Displays the LAG number which the port belongs to ¾ 802.1P Priority Config 2 802.1P/CoS MappingRequired. On QoS→DiffServ→Port Priority ¾ Priority Level Configuration Procedure Step Operation Description ¾ Dscp Priority ConfigDscp Priority Mapping Schedule Mode ¾ Priority LevelIt ranges from 0 to Priority Level Rate Limit ¾ Rate Limit ConfigBandwidth Control Egress Ratebps Storm ControlIngress Rate bps Voice Vlan Broadcast RateBps Mulitcast Rate ¾ Port Voice Vlan Mode Packet Type Processing Mode Global Config¾ Security Mode of Voice Vlan Port Mode Enter the Vlan ID of the voice VlanAging Time OUI address is aging out OUI Config Required. On VLAN→802.1Q VLAN→VLAN Config Optional. On QoS→Voice VLAN→OUI Config page, youRequired. On QoS→Voice VLAN→Port Config Required. On QoS→Voice VLAN→Global Config ACL Config ACLACL Summary ACL Create MAC ACL ¾ Create ACL¾ Create MAC ACL Rule ID Standard-IP ACL Extend-IP ACL¾ Create Standard-IP ACL Mask Policy Config Policy Summary¾ Create Extend-IP ACL IP Protocol Policy Create Action CreateIndex Displays the index of the policy Displays the ID of the ACL contained in the policy Policy Binding Binding Table¾ Create Action ¾ Policy Bind Table Port Binding Vlan BindingInterface Direction Displays the binding direction ¾ VLAN-Bind Config Application Example for ACLEnter the ID of the Vlan you want to bind ¾ VLAN-Bind Table On ACL→ACL Config→ACL Create page, create ACL On ACL→ACL Config→Standard-IP ACL page, select ACL Limit2 Snmp ¾ Snmp Overview¾ Snmp Management Frame ¾ Snmp Versions ¾ Snmp Configuration Outline ¾ MIB Introduction Snmp Config Snmp Config, Notification and Rmon Snmp View Snmp GroupMIB Object ID View Type ¾ Group Config Snmp Group Following entries are displayed on this screen Snmp User ¾ Group Table Auth Mode Auth PasswordPrivacy Mode Privacy Password Access Snmp CommunityCommunity Name MIB View Required. On the SNMP→SNMP Config→Global Required. On the SNMP→SNMP Config→SNMPConfig→Global Config page, enable Snmp On the SNMP→SNMP Config→SNMP Notification ¾ Create NotificationIP Address UDP Port Timeout RmonRetry ¾ Notification Table ¾ History Control Table History ControlRmon Group Function ¾ Event Table Event ConfigAlarm Config Variable Sample TypeRising Threshold Rising Event 131 CPU Monitor MaintenanceSystem Monitor Level Description 12.2 LogMemory Monitor Log Table Level Description Debugging¾ Log Info Time ¾ Local Log Config Local LogLog Buffer Log File Backup Log Remote Log¾ Log Host Host IP Device Diagnostics ¾ Backup LogCable Test ¾ Cable Test Network Diagnostics Loopback Tracert ¾ Ping ConfigPing ¾ Tracert Config 10 Tracert Following entries are displayed on this screen Appendix a Specifications Appendix B Configuring the PCs Configure TCP/IP component Now Appendix C Glossary Multicast Switching Remote Authentication Dial-in User Service RadiusIgmp Snooping Igmp Query Rapid Spanning Tree Protocol Rstp Simple Network Management Protocol SnmpSimple Network Time Protocol Sntp Spanning Tree Algorithm STA