Zeek Rogue DHCP and ARP Spoofing Detection: Why SPAN Matters
Built in my home lab: a 51-line Zeek script flags rogue DHCP and gateway ARP spoofing, but only after SPAN sends it the unicast attack frames.
Layer 2
Frames, MAC tables and switching behavior below the IP layer. Articles tagged Layer 2 cover forwarding decisions, trunking, loop prevention and the failure modes unique to switching.
Latest posts
BPDU Guard Lab: Catch a Rogue Bridge on an Access Port
Built in my home lab: a Linux bridge sends BPDUs, BPDU Guard err-disables the Cisco access port, and shutdown/no shutdown restores it. Storm control stays untested.
STP Root Port Election Worked Example: Cost, Neighbor BID, and Port ID
Calculate root ports on six switches using cost, neighbor BID, and sender port ID. Check real outputs, then change one cost to move SW4’s root port.
arping: Detect a Duplicate IP Address or Proxy ARP on Linux
Two MACs can answer for one IP while ping still works. Capture the duplicate, repair it, and test a Linux proxy that answers ARP but not DAD.
ARP on Linux: ip neigh, arp, and Neighbor States
The six-state neighbor machine walked live on a real lab, the tunables behind it, and why arp -n cannot show you any of it.
Native VLAN Mismatch: Read the CDP Log, Fix the Trunk
%CDP-4-NATIVE_VLAN_MISMATCH hands you both interfaces and both native VLANs in one line. The real damage is underneath it: untagged frames get re-homed at the trunk boundary and two VLANs quietly become one. Captured live on IOS XE 17.18.2 in CML.
Errdisable Recovery on Cisco: Every Cause and How to Bring the Port Back
An err-disabled port stays down forever by default, because nothing auto-recovers until you arm it. The full cause list from IOS XE 17.18.2, how to identify which one fired in ten seconds, and the captured proof that auto-recovery is a retry loop rather than a fix.
Scapy vs Cisco Layer 2 Defenses: Crafting and Spoofing Packets
Craft spoofed ARP and IP packets with Scapy against a Cisco IOS-XE lab, then watch Dynamic ARP Inspection drop every forgery and name the attacker's real MAC.