Cisco Ethernet switch Manuel d'utilisateur Page 70

  • Télécharger
  • Ajouter à mon manuel
  • Imprimer
  • Page
    / 84
  • Table des matières
  • MARQUE LIVRES
  • Noté. / 5. Basé sur avis des utilisateurs
Vue de la page 69
707070
© 2002, Cisco Systems, Inc. All rights reserved.
l2-security-bh.ppt
DHCP Starvation Attack Mitigation
¥ Same techniques that mitigate CAM flooding, can mitigate DHCP
starvation but not the Rogue DHCP server (from the DHCP RFC
2131):
ÒThe client collects DHCPOFFER messages over a period of time, selects one DHCPOFFER
message from the (possibly many) incoming DHCPOFFER messages (e.g., the first
DHCPOFFER message or the DHCPOFFER message from the previously used server) and
extracts the server address from the 'server identifier' option in the DHCPOFFER
message. The time over which the client collects messages and the mechanism used to
select one DHCPOFFER are implementation dependent.Ó
¥ RFC 3118 ÒAuthentication for DHCP MessagesÓ will help, but has yet
to be implemented
¥ Consider using multiple DHCP servers for the different security
zones of your network
¥ DHCP Option 82 on the 3550 can help:
http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/1219ea1/3550
scg/swdhcp82.htm
¥ Cisco is developing a DHCP ÒfirewallÓ for initial implementation in
our higher-end switches
Vue de la page 69
1 2 ... 65 66 67 68 69 70 71 72 73 74 75 ... 83 84

Commentaires sur ces manuels

Pas de commentaire