CDP spoofing

History

CDP was created by Cisco in 1994. Its original intent was to make it easier to find other devices on a network. CDP may be used between Cisco routers, switches and other network equipment to advertise their software version, capabilities and IP address.

The two versions of CDP are CDPv1 and CDPv2:

• CDPv1 could discover basic information between networking devices. These devices were only able to receive information about a networking device that was directly connected to it.

• CDPv2 includes more utilities such as checking if errors were made while configuring two devices (e.g.; configuring mismatched native VLANs).

Usage

CDP is enabled by default on all Cisco routers, switches and servers. The protocol can be disabled across a network; however, if it is disabled on an interface and the encapsulation is changed, it will be re-enabled on that interface. The protocol is most often used to aid network administrators by finding and discovering devices easier. When devices are discovered easier, it can help with certain network problems, device arrangement, network management and other networking tasks.

Although these can be beneficial features, attackers can accumulate this information about the devices, which leaves the device's type, IP address and IOS version exposed and vulnerable. Attackers can use this information to mimic other devices, steal information and create other various network problems.

Popeskic recommends disabling CDP on the entire device, rather than just the interfaces, to fully mitigate the threat of CDP Spoofing or attacks through CDP. Some suggest disabling CDP if it is not in use on the device or if it is not a necessity for the device.

Requirements

• CDP will only function when a packet contains the Subnetwork Access Protocol (SNAP) header. The interface must also support SNAP, for CDP to work on a router, as well.

• CDP must have the device's interfaces directly connected, otherwise, CDP cannot detect nor send out advertisements to the other device.

• CDP can only be used between Cisco devices. If a connection between a pair consists of only one Cisco device, it can only use the vendor neutral protocol: Link Layer Discovery Protocol (LLDP).

Commands

Although CDP is enabled by default, if disabled, it can be re-enabled globally (or on all interfaces) with the command: (config)# cdp run To disable it globally: (config)# no cdp run To enable it on certain interface(s): (config-if)# cdp enable To disable it on certain interface(s): (config-if)# no cdp enable In a table, to display whether or not a device has established a connection between another device or devices: (device name)# show cdp neighbors Note**:** This command will show the names of other devices, which ports are connecting the devices, model name/number, and features of the device.

To show the traffic that is passed between the CDP devices: (device name)# show cdp traffic These commands can help mitigate or detect CDP attacks, such as CDP spoofing. It can also help discover flaws within the system, e.g.; mismatched native VLANs, that could be inhibiting the connection between other devices.

How CDP works

When a router running CDP receives a CDP packet, it begins to build a table that lists the neighboring devices. Once the devices are discovered, they intermittently send a packet of updated information to each other. This packet contains various information about the interfaces and devices types and names.

These packets sent through CDP are not encrypted, creating the messages between devices to be easily read through plain-text.

Spoofing

CDP spoofing is the creation of forged packets to impersonate other devices, either real or arbitrary. This attack is a type of Denial-of-Service (DoS) attack that is used to flood connected devices using CDP.

An attacker can exploit this functionality by sending thousands of spoofed CDP packets to the multicast MAC address 01:00:0C:CC:CC:CC to fill neighbor tables in any devices on the network that run CDP. When this happens, other traffic on the network may be dropped as the device does not have the resources necessary to route it. The device's command line interface may also become unresponsive making it difficult to disable CDP during an ongoing attack.

Some administrators may disable CDP at the cost of not being able to benefit from CDP.

References

References

1. "LLDP-MED and Cisco Discovery Protocol  [IP Telephony/Voice over IP (VoIP)]".
2. (2014). "Routing and switching essentials. Companion guide.". Cisco Press.
3. Kehlet, Steve. “Handy Tcpdump Expression to Gather CDP Information -- Steve Kehlet’s Pages,” August 8, 2008. http://www.kehlet.cx/articles/186.html {{Webarchive. link. (2019-04-29 .)
4. EC-Council. Penetration Testing: Network Threat Testing. 1st ed. Clifton Park, New York: Course Technology Cengage Learning, 2011.
5. "Cisco Discovery Protocol Configuration Guide, Cisco IOS Release 15M&T - Cisco Discovery Protocol Version 2 [Support]".
6. Popeskic, Valter. (2011-12-16). "CDP Attacks – Cisco Discovery Protocol Attack".
7. "Cisco Discovery Protocol (CDP) - 26872 - The Cisco Learning Network".
8. (2015-11-13). "CCNA security. Version 2, Course booklet".
9. Barroso, David. (2020-01-03). "GitHub - tomac/yersinia: A framework for layer 2 attacks".