[Synapse] MAC Flooding [TraceMagic|Events]

Home _° SiteMap _° Analyse _° Preise _° Audits _° Software _° Download _° Syn-Wiki _° Kontakt _° Impressum

^TraceMagic ^{Trace Log Events}

MAC Flooding

MAC Flooding = Media Access Control [Layer] Paket-Flutung

Als MAC Flooding
wird der Vorgang bezeichnet, bei dem Switches
LAN-Pakete
auf allen Ports (auf alle Kabel, in alle Subnetze hinein ) senden - und somit fluten.

Die Ursachen hierfür können sehr unterschiedlich sein.

Tatsache ist, dass Paket-Flutungen im "worst case" die gesamte LAN-Struktur
des gegebenen Subnetzes lahm legen können und daher sehr gefährlich sind.

LAN-Analyse
zur Eingrenzung des Ortes der Flutung ist höchst anspruchsvoll.

Die TraceMagic-Reports können den Hinweis "Poss. MAC Flooding" (= "möglicherweise
MAC-Flutung") in verschiedenen Formen enthalten. Die häufigste ist die Kombination
mit dem Ereignis "TCP One Way"; der Kommentar bzw. Hinweis "Poss. MAC Flooding" befindet
sich in diesem Beispiel am Ende der Zeile:


[   1]  #      3 - [2006-05-05 11:27:48 .444227] ::  82.17.95.234    << 82.17.98.41     :: TCP: One Way (only Rx, no Tx) / Ports:    80 *< 58233 | 0x 0050 << 0x E379 / [MAC= Dst<-Src 00005E0001CF << 003005801C88] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #      5 - [2006-05-05 11:27:48 .444466] ::  82.17.95.234    << 82.17.98.24     :: TCP: One Way (only Rx, no Tx) / Ports:    80 *<  4434 | 0x 0050 << 0x 1152 / [MAC= Dst<-Src 00005E0001CF << 00E0180FCB62] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     11 - [2006-05-05 11:27:48 .445001] ::  82.17.95.234    << 82.17.98.41     :: TCP: One Way (only Tx, no Rx) / Ports:    80 <* 58699 | 0x 0050 << 0x E54B / [MAC= Dst<-Src 00005E0001CF << 003005801C88] / Poss. MAC Flooding  ::   ::     ::      
[   1]  #     12 - [2006-05-05 11:27:48 .445006] ::  82.17.98.45     << 82.17.95.234    :: TCP: One Way (only Rx, no Tx) / Ports: 53459 *<    80 | 0x D0D3 << 0x 0050 / [MAC= Dst<-Src 003005801B7C << 00E063047F00] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     15 - [2006-05-05 11:27:48 .445027] ::  82.17.95.234    << 82.17.98.41     :: TCP: One Way (only Tx, no Rx) / Ports:    80 <* 58700 | 0x 0050 << 0x E54C / [MAC= Dst<-Src 00005E0001CF << 003005801C88] / Poss. MAC Flooding  ::   ::     ::      
[   1]  #     24 - [2006-05-05 11:27:48 .445198] ::  82.45.82.76     << 82.17.98.33     :: TCP: One Way (only Rx, no Tx) / Ports:  2909 *<  8088 | 0x 0B5D << 0x 1F98 / [MAC= Dst<-Src 00005E0001CF << 003005801B60] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     27 - [2006-05-05 11:27:48 .445217] ::  82.50.8.199     << 82.17.98.33     :: TCP: One Way (only Rx, no Tx) / Ports: 52006 *<  8080 | 0x CB26 << 0x 1F90 / [MAC= Dst<-Src 00005E0001CF << 003005801C88] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     28 - [2006-05-05 11:27:48 .445231] ::  82.50.8.199     << 82.17.98.33     :: TCP: One Way (only Rx, no Tx) / Ports: 52006 *<  8080 | 0x CB26 << 0x 1F90 / [MAC= Dst<-Src 00005E0001CF << 003005801C88] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     29 - [2006-05-05 11:27:48 .445236] ::  82.45.11.172    << 82.17.98.41     :: TCP: One Way (only Tx, no Rx) / Ports:    80 <* 58679 | 0x 0050 << 0x E537 / [MAC= Dst<-Src 00005E0001CF << 003005801C88] / Poss. MAC Flooding  ::   ::     ::      
[   1]  #     32 - [2006-05-05 11:27:48 .445348] ::  82.100.8.125    << 82.17.98.33     :: TCP: One Way (only Rx, no Tx) / Ports: 40349 *<  8088 | 0x 9D9D << 0x 1F98 / [MAC= Dst<-Src 00005E0001CF << 003005801C88] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     33 - [2006-05-05 11:27:48 .445355] ::  82.100.8.125    << 82.17.98.33     :: TCP: One Way (only Rx, no Tx) / Ports: 40349 *<  8088 | 0x 9D9D << 0x 1F98 / [MAC= Dst<-Src 00005E0001CF << 003005801C88] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     51 - [2006-05-05 11:27:48 .446734] ::  82.17.105.238   << 82.17.98.33     :: TCP: One Way (only Rx, no Tx) / Ports:  3225 *<  8080 | 0x 0C99 << 0x 1F90 / [MAC= Dst<-Src 00005E0001CF << 003005801B7C] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     52 - [2006-05-05 11:27:48 .446744] ::  82.17.105.238   << 82.17.98.33     :: TCP: One Way (only Rx, no Tx) / Ports:  3225 *<  8080 | 0x 0C99 << 0x 1F90 / [MAC= Dst<-Src 00005E0001CF << 003005801B7C] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     58 - [2006-05-05 11:27:48 .446803] ::  82.17.98.46     << 82.17.95.234    :: TCP: One Way (only Rx, no Tx) / Ports: 60106 *<    80 | 0x EACA << 0x 0050 / [MAC= Dst<-Src 003005801984 << 00E063047F00] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     60 - [2006-05-05 11:27:48 .446822] ::  82.17.98.46     << 82.17.95.234    :: TCP: One Way (only Rx, no Tx) / Ports: 60106 *<    80 | 0x EACA << 0x 0050 / [MAC= Dst<-Src 003005801984 << 00E063047F00] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     62 - [2006-05-05 11:27:48 .446846] ::  82.17.98.46     << 82.17.95.234    :: TCP: One Way (only Rx, no Tx) / Ports: 60106 *<    80 | 0x EACA << 0x 0050 / [MAC= Dst<-Src 003005801984 << 00E063047F00] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     64 - [2006-05-05 11:27:48 .446858] ::  82.17.98.33     << 82.106.40.2     :: TCP: One Way (only Tx, no Rx) / Ports:  8088 <* 33615 | 0x 1F98 << 0x 834F / [MAC= Dst<-Src 000FEA4DB594 << 00E063047F00] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     67 - [2006-05-05 11:27:48 .446873] ::  82.17.98.46     << 82.17.95.234    :: TCP: One Way (only Rx, no Tx) / Ports: 60106 *<    80 | 0x EACA << 0x 0050 / [MAC= Dst<-Src 003005801984 << 00E063047F00] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     71 - [2006-05-05 11:27:48 .447017] ::  82.17.98.46     << 82.17.95.234    :: TCP: One Way (only Rx, no Tx) / Ports: 60163 *<    80 | 0x EB03 << 0x 0050 / [MAC= Dst<-Src 003005801984 << 00E063047F00] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #     96 - [2006-05-05 11:27:48 .447674] ::  82.17.98.22     << 82.17.95.234    :: TCP: One Way (only Rx, no Tx) / Ports: 42917 *<    80 | 0x A7A5 << 0x 0050 / [MAC= Dst<-Src 00E0180DD05F << 00E063047F00] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #    100 - [2006-05-05 11:27:48 .447725] ::  82.17.98.33     << 82.50.93.197    :: TCP: One Way (only Tx, no Rx) / Ports:  8080 <* 54159 | 0x 1F90 << 0x D38F / [MAC= Dst<-Src 000FEA4DB594 << 00E063047F00] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #    107 - [2006-05-05 11:27:48 .448344] ::  82.17.95.234    << 82.17.98.41     :: TCP: One Way (only Tx, no Rx) / Ports:    80 <* 58702 | 0x 0050 << 0x E54E / [MAC= Dst<-Src 00005E0001CF << 003005801C88] / Poss. MAC Flooding  :: · :: *** ::      
[   1]  #    110 - [2006-05-05 11:27:48 .448549] ::  82.50.8.199     << 82.17.98.33     :: TCP: One Way (only Rx, no Tx) / Ports: 52006 *<  8080 | 0x CB26 << 0x 1F90 / [MAC= Dst<-Src 00005E0001CF << 003005801C88] / Poss. MAC Flooding  :: · :: *** ::

Der Zusammenhang mit "TCP One Way" ist kein Zufall: Falls TCP-Pakete durch einen Switch
geflutet werden, erscheinen am MessPunkt nur die von A nach B adressierten TCP-Pakete,
nicht aber die von B nach A zurück gesendeten Antwort-Pakete, da der Empfänger B
nicht an einer der von Flutung betroffenen Leitungen angeschlossen ist.

Nun stellt sich die Frage:
Welcher Switch flutet die Pakete, und warum geschieht dies?

Weiter gehende Betrachtungen / Lösungsansätze:

MAC Flooding (1)

Erzeugt am (Datum/Uhrzeit): 2012-05-15 / 00:26:59 ... via SYNcreator


	"Auf den ersten Blick sehen, was ist."
"Sie zeichnen auf, wir werten aus"