Solution To Arp Attacks In Campus Network - Zte ZXR10 2900E series Configuration Manual

Solution
The engineers of company B change the shared key to "amtium", and the problem is solved
completely.

7.3.9 Solution to ARP Attacks in Campus Network

Symptom
Eleven access layer switches ZXR10 2900E in the same VLAN in a student dormitory
building cannot connect the network. 40% of users in this building failed to access the
Internet.
Fault Analysis
After checking the network management system, maintenance engineers found that the
eleven switches were disconnected and failed to be pinged. The maintenance engineers
arrived at the weak electricity well in which four switches were installed, accessed the
switch whose IP address was 172.168.0.123 through HyperTerminal, and found its CPU
usage reached 93%–100%. The maintenance engineers checked the alarm information
and configuration information, but no exception was found. The maintenance engineers
then accessed the convergence layer switch T40G and found an alarm "port 4 receives
too many ARP broadcast packets". After checking the traffic on this port, the maintenance
engineers found that about 100,000 broadcast packets were added every ten seconds.
After analyzing the ZXR10 2900E connected to the port, the maintenance engineers found
the following conditions:
1. There was a loop on the user side.
2. A user's computer was infected by a virus and sent broadcast packets continuously.
3. A user's computer was installed with the ARP attack software and sent ARP attack
packets continuously.
The IP address of the ZXR10 2900E connected to the port was 172.168.0.111. The
maintenance engineers connected the switch through a network cable and captured
packets. After analyzing the packets, the maintenance engineers found that a computer
with the MAC address "00:19:e0:a9:5a:fc" sent ARP broadcast packets continuously.
Based on the label on the network cable, the computer was in room 2606. After the
maintenance engineers removed its network cable, the eleven switches recovered normal
and CPU utilization was no more than 5%.
Solution
1. Filter out the MAC address of the computer on the access layer switch and prohibit it
from accessing the Internet.
2. Notify the central equipment room of the school to prohibit the computer from
accessing the Internet before its hard disk is formatted and the system is reinstalled.
3. Install an ARP virus kill tool on all computers.
SJ-20130731155059-002|2013-11-27 (R1.0)
7-9
ZTE Proprietary and Confidential
Chapter 7 Maintenance