427 Botnet fm qxd

www.syngress.com
150
Chapter 5 • Botnet Detection: Tools and Techniques
427_Botnet_05.qxd 1/9/07 9:59 AM Page 150

---

Layer 2 Switches and Isolation Techniques
Layer 2, meaning Ethernet switches, might be a topic that most people do not
consider very much or very long in terms of security. But some attacks can
take advantage of weaknesses at Layer 2. For example, consider the popular
Ettercap tool (http://ettercap.sourceforge.net), which fundamentally relies on
attacks such as ARP spoofing or filling a switch forwarding table full of fake
MAC addresses to enable password sniffing. (See www.securitypronews.com/
securitypronews-24-20030623EtterCapARPSpoofingandBeyond.html for
more discussion of Ettercap-based attacks.) 
We need to define a few terms before we go on:
■
Broadcast domain
Essentially, a broadcast domain on Ethernet is
the set of systems reachable by an ARP broadcast. If one host sends
an Ethernet broadcast, all the other hosts that receive the broadcast
packet are in the broadcast domain.These days a broadcast domain
can be a virtual as well as a physical idea. Ethernet switches are
capable of using Virtual LANS (VLANS) so that ports (interfaces) on
more than one switch can be “glued together” to make a virtual net-
work. At least one and sometimes more IP subnets can exist in a
broadcast domain.
■
Unicast segmentation
This idea is an old Ethernet bridge notion
carried over to modern Ethernet switches. Essentially, the switch tries
to learn which MAC address is associated with which port.This pro-
cess is called 
adaptive learning
.The hoped-for result is called 
Unicast
segmentation
. For example, if two hosts in the broadcast domain are
communicating via Unicast packets (say, A and B) and the switch for
some reason does not know the port for host B, it will flood the
packets for B out other ports (say C, D, and E). If it does know where
B is to be found, then C will not see the packets.This keeps C’s
switch connection uncluttered in terms of bandwidth. It also means
that C is not able to “sniff ” A and B’s conversation unless explicit
techniques such as turning on port mirroring in the switch or
implicit techniques such as a switch forwarding table attack (discussed
later) are used.