layer 2 hardening, port security, dhcp snooping, arp inspection

the floor nobody thinks about

everyone obsesses over firewalls, vpns, and endpoint security, and meanwhile layer 2, the actual switches moving frames around your building, sits there wide open. here's the uncomfortable truth: if someone gets a cable into an unprotected switchport, they can flood your mac table, stand up a fake dhcp server, or spoof arp and read traffic that was never meant for them. none of that requires fancy tools. it's built into how ethernet and arp work by default. the fix is three features that ship on basically every managed switch and most people never turn on.

port security: stop mac flooding before it starts

switches learn which mac address lives on which port by watching traffic. that table has a limit. if an attacker floods a port with thousands of fake source macs, the table fills up, and a lot of switches fail open, meaning they start broadcasting everything out every port like a hub. that turns your switch into a wiretap.

port security fixes this by limiting how many mac addresses a single port is allowed to learn. you can also use sticky learning so the switch locks in the first mac it sees and remembers it, and you set a violation action like restrict or shutdown so the port reacts the second something unexpected shows up.

switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict

that's it. one unexpected mac, port either drops the extra traffic or shuts itself down depending on what you chose. no more flooding the cam table from a random access point.

dhcp snooping: kill rogue dhcp servers

dhcp has no authentication built in. any device on the segment can answer dhcp requests, and clients just believe whichever offer arrives first. that means someone plugging in a wireless router with dhcp enabled, or running a malicious dhcp server on purpose, can hand your devices a fake gateway and quietly become the middleman for all their traffic.

dhcp snooping fixes this by making the switch classify ports as trusted or untrusted. trusted ports are allowed to send dhcp server responses, like offers and acks. untrusted ports, which is everything else, get those responses blocked. only your actual dhcp server's uplink should be trusted.

ip dhcp snooping
ip dhcp snooping vlan 10
interface gi1/0/1
 ip dhcp snooping trust

now if someone plugs in a rogue dhcp server on an access port, its offers get dropped at the switch before any client ever sees them.

dynamic arp inspection: shut down arp spoofing

arp is even more trusting than dhcp, it just accepts whatever mac-to-ip mapping shows up and updates the local cache. that's how arp spoofing works, an attacker sends fake arp replies claiming to be the gateway, and every device on the segment starts sending its traffic straight to the attacker instead.

dynamic arp inspection, or dai, fixes this by checking every arp packet against the dhcp snooping binding table, which tracks which ip got leased to which mac on which port. if an arp packet doesn't match a known legitimate binding, it gets dropped instead of trusted.

ip arp inspection vlan 10
interface gi1/0/1
 ip arp inspection trust

this is why dhcp snooping and dai go together, dai relies on the binding table that dhcp snooping builds. one protects the address assignment, the other protects the address resolution built on top of it.

trust boundaries are the whole game

notice the pattern across all three: you're defining trust explicitly instead of letting every port assume equal trust by default. the uplink to your real dhcp server is trusted, everything else isn't. that's the actual security model here, not some magic feature, just refusing to trust ports you don't control.

if you're auditing your own switches, walk every access port and ask: does this port need to learn more than 1 or 2 macs, should this port ever send a dhcp offer, should this port ever claim to be the gateway. if the answer is no to all three, lock it down with the config above.

the takeaway

layer 2 attacks are old, boring, and still work constantly because nobody hardens the switch. port security stops mac flooding, dhcp snooping stops rogue dhcp servers, and dynamic arp inspection stops arp spoofing, and all three are already sitting in your switch's config guide waiting to be turned on. go check your access ports this week. the floor holds up everything else, so stop leaving it unlocked.