MAC/IP address spoofing
MAC/IP address spoofing is a very serious security threat. The essence of MAC address spoofing is that MAC address duplication occurs, which results in the learning and migration of MAC address of switching chip, and some users can not access the Internet. MAC address spoofing can be divided into the following two types:
(1) User's MAC address spoofing.
(2) MAC address spoofing of upstream network service servers (such as BRAS, DHCP server/relay, default gateway, etc.).
Because of the characteristics of Ethernet itself, MAC address information is public. Through scanning tools, users can easily access other users'MAC address information. If the same MAC address appears on different user ports of the device, it will cause the learning disorder of the MAC address and make the user unable to access the Internet. In order to enhance security, in broadband access networks, it is generally required to isolate user ports at access nodes: users under the same VLAN can not communicate with each other, but can only communicate with upstream sink ports. User port isolation can be achieved through private virtual local area network (PVLAN) technology. Not all switching chips support the function of PVLAN. Even if they support the function of PVLAN, it may cause the problem of MAC address duplication due to improper MAC address settings of devices, or users can obtain other users'MAC through other channels (such as "violent" MAC attempts). PVLAN technology itself is not enough to completely solve the problem of user-side MAC address spoofing
