LAN security: ARP, DHCP and 802.1X
You watch attacks such as ARP spoofing, rogue DHCP and MAC flooding in your own isolated lab, detect them and stop them with 802.1X and port security.
Level 301 · 19 lessons · 15 practice labs
Lessons
Layer 2 threats
- The LAN threat model: why inside is not safe
- Seeing ARP spoofing in your own lab
- Detecting ARP spoofing: arpwatch and logs
- MAC flooding and a switch that acts like a hub
- A rogue DHCP server and its impact
- Short task: find the rogue DHCP server on the network
Defences
- DHCP snooping and dynamic ARP inspection
- Static ARP and filtering on the bridge (nftables bridge)
- Port security: MAC limits
- Private VLANs and client isolation
- VLAN hopping and trunk hardening
- Short task: isolate guest devices from each other
802.1X
- Network access control and the 802.1X roles
- Setting up FreeRADIUS
- EAP methods: PEAP and EAP-TLS
- Opening a port with wired 802.1X
- Dynamic VLAN assignment with RADIUS
- Short task: set up a port that only certified devices can use
Wrap-up
- Capstone: harden an office LAN and detect an attack attempt
Practice labs
- Two IPs, one MAC in the ARP table: Detect an ARP poisoning attempt running on your lab segment using the client’s ARP table and tcpdump, and report the attacking machine’s MAC and IP.
- Pull the incident out of arpwatch logs: Separate normal changes from a real spoofing incident in a week of arpwatch logs, and document when the incident started and ended.
- Protect the gateway’s MAC: Block forged ARP replies for the gateway address with nftables bridge rules, repeat the attack in your lab and show the clients are no longer affected.
- A rogue DHCP server in a capture: Separate the offers from two DHCP servers in a capture from Cinnamon Café’s network, and list the rogue one’s MAC address and the clients that took its leases.
- DHCP only from the trusted port: Write bridge rules that accept DHCP server replies only from the trusted port, restart the rogue server and show clients still getting the right address.
- The address pool ran dry in a minute: Detect from server leases a DHCP starvation attack triggered in your lab, prevent it with per-port MAC limits and lease settings, and show new clients getting addresses.
- Kiosks apart, printer reachable: Separate the kiosk terminals in Orchid Hotel’s lobby from each other with bridge port isolation, keep their access to the shared printer and the internet, and test both ways.
- The switch started acting like a hub: Show the lab MAC-flooding attempt filling the FDB and spreading traffic to every port, set a per-port learning limit and prove the attempt no longer works.
- VLAN hopping with double tags: Run a test in your lab showing double-tagged frames reaching another VLAN through the trunk setup, harden the native VLAN and trunk settings, and prove the test now fails.
- RADIUS rejects the user: Find in debug mode why FreeRADIUS rejects a test user, fix it and show an Access-Accept with radtest.
- Right user, closed port: Find in the RADIUS logs the EAP method and certificate-check mismatch keeping a client with correct credentials from opening the port, fix it and show the port opening.
- VLAN by certificate: At Atlas Clinic, place devices authenticated with EAP-TLS into different VLANs by role through the RADIUS reply, and show a device with an expired certificate being rejected.
- The weak points of an office LAN: Review a small office LAN’s configuration, list its open points for ARP, DHCP, ports and VLANs in priority order, and confirm each with a test.
- The printer that cannot do 802.1X: Admit the printer that lacks 802.1X with MAC-based fallback into the printer VLAN only, then test and limit what a lab device copying that MAC can reach.
- After hardening, printers and phones went quiet: Find the legitimate devices that stopped working at Demirhan Machinery after DHCP protection, port limits and 802.1X were switched on, give each the right exception without loosening protection, and test that both devices and protection work.
About this course
You watch attacks such as ARP spoofing, rogue DHCP and MAC flooding in your own isolated lab, detect them and stop them with 802.1X and port security.
What you will learn
- Layer 2 threats
- Defences
- 802.1X
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.