生成树协议操纵攻击及其应对安全策略研究与实现  

Research and Implementation of Spanning Tree Protocol Manipulation Attack and Its Countermeasures

作　　者：刘叶梅 徐龙泉 Liu Yemei;Xu Longquan(YGSOFT Inc.,Zhuhai 519085;Zhuhai Technician College,Zhuhai 519015)

机构地区：[1]远光软件股份有限公司,珠海519085 [2]珠海市技师学院,珠海519015

出　　处：《现代计算机》2022年第22期118-120,共3页Modern Computer

摘　　要：交换机会使用生成树协议(STP)来防止环路,为了确保管理员能够按照自己的需求塑造第2层网络,端口的胜选和落选需要根据一个管理员可以进行配置的参数来决定,这就给攻击者制造了可乘之机,也就是操纵攻击。规避这类攻击的逻辑,是需要区分哪些交换机端口可以连接交换机,或者哪些交换机的端口可以连接根桥,而哪些交换机端口只能连接终端设备。具体介绍了BPDU防护、BPDU过滤和根防护这三种应对安全策略及其实现过程。FromSwitches use Spanning Tree Protocol(STP)to prevent loops.To ensure that administrators can shape the Layer 2 network to their needs,port wins and losses are determined by a parameter that the administrator can configure.The at⁃tacker creates an opportunity to manipulate the attack.The logic to avoid such attacks is to distinguish which switch ports can be connected to switches,or which switch ports can be connected to the root bridge,and which switch ports can only be connected to terminal devices.This paper specifically introduces the three security strategies and their implementation process of BPDU guard,BPDU filtering and root guard.

关 键 词：生成树协议 BPDU防护 BPDU过滤 根防护 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]