Yersinia Spanning Tree Protocol (STP)

STP is a layer 2 protocol that prevents loops from occurring in a switched network. Each switch involved in the process sends out BPDU packets to elect a root bridge and from here, ports are given a role of either root, designated, alternate, backup or disabled.

Ports that are either root or designated are active ports in the topology, whereas alternate, backup and disabled ports do not forward packets.

The root switch has all designated ports and each other switch has one root port which is the fastest path to the root bridge and any number of other port types.
More details on the STP protocol can be read at: Cisco STP Summary

When the STP protocol screen is opened in Yersinia ncurses, each unique BPDU seen by the active interface is listed. The up and down arrows can be used to click on the BPDU to inspect the contents.

In the example below, the first BPDU seen is from the switch that my linux box is connected to. Opening this BPDU it can be seen that the RootId matches what is on the switch.

Further down, surrounded by green is the details that Yersinia has populated into a BPDU that it will send in an attack. In the example below, it can be seen that the populated RootId is 5080.760F0E14AC58 which is lower than the RootId in the received BPDU (8028.0014A9B0E800). Which means the switch will receive a superior BPDU when this packet is sent.

Clicking 'x' in Yersinia shows the available attacks for the active protocol. In this case, STP has 6 available attacks to choose from.

Yersinia Spanning-Tree Protocol attack options

Attack 0: sending conf BPDU

This attack simply sends a single BPDU of the format shown in the green frame above. It will appear to the switch as a superior BPDU, but because it is only one BPDU the root bridge will only transition until the Max Age times out (in this case 20 seconds).

Switch behaviour when attack 1 is launched

The screenshot above shows the behaviour of the switch when it receives the BPDU. It receives the BPDU, acknowledges the new root bridge on Fa0/31, 20 seconds later it returns to being the root bridge.

Attack 1: sending tcn BPDU

A TCN (Topology Change Notification) BPDU lets the rootbridge know that something has changed in the network. It is always forwarded through the root port until it arrives at the root bridge, which then sends out a BPDU with the TC (Topology Change) bit set. The TC bit is set by the root for a period of max_age + forward_delay seconds, which is 20+15=35 seconds by default.

Further Research:

Looking at the MST protocol

How to take advantage of being the Root bridge (all your broadcasts belong to me)

PVST+ simulation weakness that can be exploited

Yersinia in the Network

"Yersinia is a network tool designed to take advantage of some weaknesses in different network protocols" - http://www.yersinia.net/

I think Yersinia is a pretty cool tool and over the Christmas break I decided to see how easy it is to exploit each of the network protocol it implements.

After installing Yersinia, to run it with the ncurses GUI (which is good for beginners), type:

yersinia -I

 From here you can press "h" to see the options. Basic commands is "g" to select the protocol you want to attack (or use F2 - F9 to click through them). When you are on the protocol page, press "x" to list the available attacks and "l" to list which attacks are currently running.

I'm going to go through each protocol attack and how they work in my subsequent blogs posts. As of writing, in Yersinia v0.7.3 the protocols listed below are implemented. Each protocol will be a link to my blog post with more detail.

Yersinia can be used to test the following protocols on the network:

• Spanning Tree Protocol (STP)

• Cisco Discovery Protocol (CDP)

• Dynamic Trunking Protocol (DTP)

• Dynamic Host Configuration Protocol (DHCP)

• Hot Standby Router protocol (HSRP)

• IEEE 802.1Q

• IEEE 802.1X

• Inter-Switch Link Protocol (ISL)

• VLAN Trunking Protocol (VTP)

• Multiprotocol Label Switching (MPLS)

After I fully understand the exploitation of all these protocols, I'd like to add to Yersinia. :)

MST and Port Priority on VIRL

I really wanted to cement my knowledge of MST and Port Priorities, and VIRL was perfect for this.  All I did was use two switches connected with dual links. I defined 4 new vlans and then put two in MST 1 and two in MST 2.

What I noticed though was that both MST 1 and MST 2 were using Gi0/1 to forward, even though I had set SW1 as the root for MST1 and SW2 as the root for MST2. So I used port-priorities to configure MST1 to use Gi0/1 and MST2 to use Gi0/2.

The configuration of port-priorities is shown below:

VIRL was perfect to investigate and cement MST and port-priorities for me, and I didn't have to waste any of my INE rack rental time or purchase switches (which seem to be so much more expensive then routers for my CCIE lab)

VIRL Troubleshooting

VIRL is fantastic to use, but I have had some issues with it lately so I thought I might detail the fairly simple solutions I found.


Virtual Interface Creation Failed Error on launching simulation:

First one happened when I clicked yes to the update prompt. It ran through updates and then when I open Maestro and tried to launch a simulation I got the following error:

Node "R1" state changed from BUILDING to ERROR with message: Virtual Interface creation failed:   File "/usr/lib/python2.7/dist-packages/nova/compute/manager.py", line 297, in decorated_function

The correct way to do the upgrade can be found here. But since I was stuck in some quasi-half upgrade stage, all I had to do was run the following commands:

sudo vinstall vinstall

sudo salt-call saltutil.sync_all

sudo vinstall salt

sudo salt-call state.sls openstack

sudo salt-call state.sls openstack.setup

sudo salt-call state.sls openstack.restart

Now my VIRL is launching simulations properly again.

Connection Refused to console:

This one is so annoying, because it appears like everything is working but when you try to get to the console of the running devices you get the following error:

This had a crazy simple solution. I had a VPN running on the VM which was interfering with the routes to the console. The easiest way to fix this was to disable the VPN. And now I can get to the console again. :)

WAN Circuits

HDLC:
- default serial encapsulation
- no advanced features
- problems with vendor interoperability
- very easy config "no shut", configure clockrate

HDLC

PPP:
- negotiation, authentication (PAP, CHAP), PPPoE
- easy to configure, 'encapsulation ppp'
- debug ppp negotiation
- pap: password authentication protocol
- challenger: "ppp authentication pap"
- reponse: "no ppp pap refuse", "ppp pap sent-username... password"

PPP

MST Revision

Required information for an MST instance:

• instance name
• revision number
• mst to vlan mappings

intra region:
vlan to stpis are manually defined
undefined vlans fall into CIST (MST 0)

inter region:
details between regions are not know

MST is backwards compatible with legacy CST and PVST+
behaves like inter-region MST
CST root must be within the MST domain

migration, start from root bridge and work your way out

Config Steps:
1. define the following in MST config mode:
region name
revision number
VLAN to isntance mappings
2. Enable MST globally

Same election process as CST/PVST+

Changing BID priority, port cost, port priority - all done for the instance
eg. spanning-tree mst [instance] priority

BEST PRACTICE: 3 spanning-tree instances in MST

Layer 2 Final Revision

This weekend I consolidated my Layer 2 knowledge by finishing off the first 3 chapters of the Official CCIE Study Guide. I was pretty confident in Layer 2 stuff, but I still managed to pick up a few reminders of gotchas below.

Etherchannel Notes from this weekend:

To check the load balancing accross the links use the following command:

show port-channel traffic

:D

Reminder - for Layer 3 port-channels, configure 'no switchport' on the physical interfaces first before configuring the port-channel

Layer 2 reminders:

Ethernet V2 and IEEE802.3 frames are different.
Ethernet V2 have a 2-byte Type field.
IEEE802.3 have a 2-byte Length field & 3 x 1-byte fields - Destination Service Access Point (DSAP), Source Service Access Point (SSAP) and Control. These are called LLC fields.

VTP gotchas this weekend -

without any configuration, the default is server mode
without any domain name a switch will assume the domain name of the first received VTP update
Although VTPv3 supports extended vlans, it does not prune them :O
VLAN database mode ALWAYS only allows manipulating normal range VLANs, regardless of the VTP version and VTP mode

PPP header = 2 bytes
PPPoE header = 6 bytes

Private VLANs can always communicate with trunk ports

STP: port costs are only applied to RECEIVED BPDUs, not sent BPDUs

Here are my results from the post chapter quizzes... not stunning, but mostly just misreading questions or forgetting something small:

Switched Networking Basics Quiz

Virtual LANs and VLAN Trunking Quiz

Spanning Tree Protocol Quiz