Source address from a CDP Spoofing packet

[mcollins1983]

Hello,

I was was wondering if anyone knows if the same or different source address is used in a CDP Spoofing attack?

Reason I ask is, I'm wondering if using port security would help to guard against such an attack.

Thanks.

[acampbell]

Hi,

CDP uses a layer2 MAC multicast address  01:00:0C:CC:CC:CC as the destination

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/cdp/configuration/15-mt/cdp-15-mt-book/nm-cdp-discover.html

Also see https://wiki.wireshark.org/CDP for frame inspection

If you are worried about CDP coming into ports you dont want it on then it would be OK to disable it on a per port basis required

!

int g1/0/1

no cdp ena

!

Regards

Alex

[Tausif Gaddi]

Cisco Discovery Protocol Configuration Guide, Cisco IOS Release 15M&T  http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/cdp/configuration/15-mt/cdp-15-mt-book/nm-cdp-discover.html is a good reference.