CloudLabBox
Try the free demo

Network+ lab 21 of 27

Switch security: stopping rogue DHCP and ARP spoofing

Attack a small office LAN from a Linux host, then defend it. A rogue DHCP server hijacks a client's gateway until DHCP snooping stops it, ARP spoofing is blocked by dynamic ARP inspection, MAC spoofing trips port security, and user ports stop negotiating trunks.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 3,328 MB in total. That fits the free demo too.

In your workspace: Shared, then CompTIA Network Plus N10-009 guided labs, then 21 - Switch security - stopping rogue DHCP and ARP spoofing

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 70 minutes
Nodes need
5 vCPU, 3,328 MB
Smallest plan
Lite

The scenario

A visitor at Harbour Logistics plugged a laptop into the hot desk (SW1 Gi0/3). Nothing stops it from pretending to be the DHCP server or the default gateway. You'll play both sides: first ROGUE attacks the LAN, then you harden SW1 so the same attacks fail, with evidence for each.

DevicePortAddressRole
R1SW1 Gi0/010.10.10.1/24gateway and legitimate DHCP server
H1SW1 Gi0/1DHCPstaff Linux PC (the victim)
PC1SW1 Gi0/2DHCPstaff PC
ROGUESW1 Gi0/310.10.10.66/24attacker's laptop
(internet)R1 Loopback0203.0.113.1test target

Only do this in a lab. Running these attacks on a network you don't own is illegal in most countries.

What you’ll practise

  • Explain rogue DHCP, ARP spoofing/poisoning, MAC flooding and VLAN hopping attacks
  • Configure DHCP snooping with trusted ports, and fix the option 82 side effect
  • Configure dynamic ARP inspection based on the snooping bindings
  • Configure port security with a maximum, sticky learning and a violation mode
  • Harden access ports against trunk negotiation
  • Read the evidence: bindings, drop counters, violations and logs

The tasks

  1. Prepare the attacker
  2. Attack 1, a rogue DHCP server
  3. Defend with DHCP snooping
  4. Attack 2, ARP spoofing, and the defence
  5. Attack 3, MAC spoofing, and port security
  6. Stop VLAN hopping

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Switch security - stopping rogue DHCP and ARP spoofing5 nodes, 4 links. Every link is listed as text below the diagram.R1SW1H1PC1ROGUEGi0/0Gi0/0Gi0/2eth0Gi0/1eth0Gi0/3eth0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to SW1 Gi0/0
  • SW1 Gi0/1 to H1 eth0
  • SW1 Gi0/2 to PC1 eth0
  • SW1 Gi0/3 to ROGUE eth0
Nodes in Switch security: stopping rogue DHCP and ARP spoofing, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
SW1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 768 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
ROGUEAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CompTIA Network Plus N10-009 guided labs.

  3. Open 21 - Switch security - stopping rogue DHCP and ARP spoofing and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Network+ labs

All Network+ labs

Related labs in other courses

CloudLabBox is independent of CompTIA, Cisco and Netgate. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.