2020 3rd International Conference on Computing, Mathematics and Engineering Technologies (iCoMET)

Network Security Issues of Data Link Layer: An

Overview
Shahid Mahmood Syed Muhammad Mohsin Syed Muhammad Abrar Akber
Department of Computer Science, Department of Computer Science, School of Computer Science and
Virtual University of Pakistan, COMSATS University Islamabad, Technology, Huazhong University of Science
Lahore, Pakistan Islamabad, 45550, Pakistan and Technology, Wuhan, 430074, China
Email: shahid1mahmood [email protected] Email: [email protected] Email: [email protected]

Abstract—There is a cardinal infrastructure of application even the educational institutions on risk. The attackers getting
software’s, protocols, and physical devices over different sort of access not only to the private lives of humans but also to the
wired and wireless networks, that need to communicate with each critical infrastructures of industries and the country [1]–[4].
other, whether located not only on earth but also in the space.
OSI seven-layers model has become an international standard Mostly, network layer in the OSI model is considered the
to communicate securely and confidently among different kinds weakest section. While the layer 2 (data link layer) is ignored
of the corporate networks while keeping the other OSI layers and not handled properly, that can be the possible weakest
unfamiliar with the current layer of communication. This secrecy layer among all the OSI model [3]. Researchers have devised
among the layers results in vulnerability to attack in a way that
if one layer is compromised to attack, the other layers will not be
the techniques to prevent trojans, malicious emails, infected
able to detect it properly. This individuality of OSI layers makes documents, and the application from the transport layer or the
the whole network severely vulnerable to attack particularly due network layer. But they ignore the data link layer and mostly
to the data link layer as compared to other layers. Generally focus on the security of the device itself, rather focusing on
network security problems at layer 2 are not properly addressed the whole management systems of an enterprise [5]. However,
as compared to other layers, rather the people focus on the
device’s security for the whole management system instead. This
to attack the data link layer is not an easy task, and most of
paper encompasses network security problems faced due to lack the times, network administrators think it is safe, but they
of hardening the layer 2 and it also describes, how it makes a LAN underestimate the attackers.
or the system of networks more vulnerable to attacks, especially Usually, an attacker can affect the IP and Wireless LANs
for the MAC flooding, ARP spoofing, VLAN hopping, DHCP
in the following ways.
attacks, Denial-of-Service (DoS) and Spanning Tree Protocol in
a very concise manner. • Denial of Service Attack on the LAN
Index Terms—OSI model, Security, DoS attack, ARP, STA • Eavesdrop the electronic transmission
• Analyzing and manipulating the flowing data
I. I NTRODUCTION • Two or more than two of above attacks in combination

In the recent era, we have occasionally listened about the If an attacker is able to apply any of the above attacks at the
hacking events occurred in a government portal, research LAN or network of systems, he can affect the comprehensive
institute security center, hacked the sensitive information from security strategy of an organization, critical infrastructure of
an oil company, jammed the power station or an airport. As the electronic communication, government management systems
Information Technology (IT) and communication equipment and/or the public institutions seriously. Usually, a critical
such as cellular phones and the tabs are gradually becoming infrastructure within a country is monitored via internet secu-
an essential part of our daily life, the probability of such rity service providers and mobile communication companies.
attacks is rapidly increasing correspondingly. These devices There are pros and cons of information transmission through
are making the life more convenient and getting our trust the local area network and/or internet. For instance, control
rapidly, as well. For instance, these devices are performing information, sometimes can’t be successfully transmitted to
functions of perception control. The convenience got by human the end devices due to denial-of-services (DoS) attack. DoS
is not cost-free, as they are putting our lives, our country, and attack is easy to be implemented in the Wireless LANs as the
frequency jamming equipment are easily available commer-
cially. In last few years, the Wi-Fi technology has flourished
978-1-7281-4970-7/20/$31.00 2020
c IEEE very rapidly, and Wi-Fi 6 has achieved its theoretical speed of

Authorized licensed use limited to: Sharda University. Downloaded on July 18,2023 at 08:12:17 UTC from IEEE Xplore. Restrictions apply.
 Fig. 2: Functions and attacks at each layer of OSI model

procedural bases. Data link layer consists of two sub-layers,

Fig. 1: OSI seven-layer model [1], [3], [10]
Logical Link Layer (LLC) and MAC layers. Layer 2 of the OSI
model is responsible to provide the following functionalities
about 9.6 Gbps. By this development in data transmission, one [7]–[9].
can imagine the future of Wi-Fi technology [4], [13], [17]. • Framing
In summary, above-mentioned attacks are likely to attain the • Access control
IDs and user passwords, which is a threat to wireless local area • MAC addressing
networks. On the other hand, the manufactures are also aware • Data rate control
of the attacking techniques, so they also do every possible • Media access control (MAC sublayer)
effort to mitigate these threats. For e.g., the efforts made by the • Error correction received from the physical layer
manufacturers to mitigate the Layer 2 CAM overflow attack,
III. S ECURITY ATTACKS AT DATA LINK LAYER
Cisco has introduced new technology into iOS called port
security. In this paper, we are particularly focusing on the Considering the importance and criticality of data link layer
security problems and potential back-doors in the data link in OSI model, we have selected it for comprehensive survey
layer of the OSI model. related to its security issues. Following section encompasses
Section 2 of this study elaborates the background of the the detailed description of security threats of data link layer.
topic while prominent security attacks on data link layer are
discussed in section 3 of this study. Section 4 is composed of A. Spanning tree protocol
conclusion and the future work. There can be multiple paths among the client and server to
provide a backup path, while the original path is not available.
II. BACKGROUND Due to multiple paths among a server and a client’s system,
To comprehensively understand the network security prob- three types of frames can loop forever in the network that
lems and issues in the data link layer, we need a brief is uni-cast, broadcast, and multi-cast. It is the spanning tree
introduction to this layer. The OSI seven-layer model was protocol (STP) that detects these looping frames and prevent
developed according to the International Organization for them from being forwarded to the next switch or bridge in
Standards (ISO), so that different kind of devices having a the network, having multiple paths. Spanning tree protocol
variety of software applications installed, distinct physical uses a spanning tree algorithm (STA) called 802.1D IEEE and
characteristics, and interfaces can communicate with each it is designed to run on the switches and/or bridges that are
other securely and confidently. Each layer above the current compatible with standard 802.1D IEEE [11]. STP ensures that
layer is served by the current layer and each above layers rely there are no loops while having redundant links in the network.
on the functionality of its attached downward layer. But the In case of failure of the original link, these are the redundant
functionality of each layer is contrasting from each above and links that provide the connectivity on the local area network.
below the attached layer [6]. Fig. 1 of this study shows the If we don’t employ a single STP at a time on the switch
OSI reference model having a short description of each layer. of a local area network (LAN), then in case of failure of the
Whereas, role and responsibility along with potential threats original path, there will be several paths having loop messages
at any specific layer are shown in Fig. 2. in the intended network.
Data link layer establishes the communication among the There are several types of STPs. It is recommended to use
variety of devices in the system of networks, identifying a single type of STP at a time, to avoid the timing problems
their peculiar MAC address, corrects the errors occurred at on the switched networks. These timing issues may result
the physical layer and transfers data on the functional and in blocking and forwarding problems in virtual local area

Authorized licensed use limited to: Sharda University. Downloaded on July 18,2023 at 08:12:17 UTC from IEEE Xplore. Restrictions apply.
 cost or smaller root ID is selected as the root bridge and all
other switches not allowed to forward the traffic and/or not
to become a root bridges due to their higher root ID. Other
switches do not advertise their ID anymore due to the root ID.
The attacking technique in this scenario is that an attacker
multi-casts the falsely configured BPDUs to the switches on
a VLAN. Devices on the corporate network consider the
attacker’s switch as the root bridge. To make the attack
successful, the attacker needs two bridges, two switches or two
wireless local area network (WLAN) connections to influence
the network effectively. After becoming root, the attacker can
listen to all the traffic of the victim’s network and even can
insert new frames. The attacker being the root can do a man-in-
Fig. 3: Spanning tree protocol before root privileges [8], [12] the-middle attack (MITM) while being in the middle position
of the server and the client [12]. This scenario is shown in
Fig. 4 of this study.

B. Basic VLAN hopping attack

According to IEEE 802.1Q, a root bridge is allowed to carry
all the VLAN’s traffic from one switch to the other switch,
while the access link switch connects the end-users to access
their particular VLAN. There can be many open ports over
a VLAN to allow the request of a new connection from the
members of the network. Anyone can connect his laptop to
the local area network through these open ports. To automate
the discovery of trunk links between the switches, Cisco has
devised a protocol called dynamic trunking protocol (DTP).
The DTP can be used to negotiate as well as for the formation
of new trunk links in a VLAN. Furthermore, DTP can also
be used to discover the encapsulation used, either Cisco ISL
Fig. 4: Attacker is able to illegally listen the traffic [8], [12] (Inter-Switch Link) or IEEE 802.1Q. [1], [13]–[15].
An attacker sends the false DTP messages over a VLAN to
turn an access link into a trunk link to access all the traffic
networks (VLANs). Because at a time, a single switch can that is normally filtered from the access links. In this way an
handle a single flavor of STP. There is a main control unit in attacker can view all communicating information of a trunk
the network called root bridge, responsible for doing decisions link.
related to the network, for example, it decides about the port,
either to put it into a forwarding or blocking mode etc. On C. Double tagging VLAN hopping attack
the bases of the network devices, VLAN is classified into two To operate the VLANs, the messages containing additional
environments, one is switched environment and other is the 802.1Q header rotate among the backbone and end access
bridge environment. In the switched environment, usually, the point in the entire network. The 802.1Q header contains two
root switch is considered the root bridge of the network. As tags, one for the end-user that is outer tag and other is the
each VLAN has its domain, so each VLAN must have its service provider that is the inner tag of the message rotating
separate root bridge as well. However, a single switch may in the VLAN. The double tags header allowed only to the root
serve as the root of a single or all the VLANs simultaneously. switches allowed to send while the access links are not allowed
In bridge environment, decision of root can be made au- in the VLAN. The outer tag is stripped out as the frame
tomatically or manually, however,the wrong selection of the enters the trunk links of a VLAN (dynamic desirable option
root bridge can result in sub-optional paths in the networks. enabled switch), while the other tag contains the victim’s
For the selection of a switch or a port as a root switch or a related information delivered to the victim, as shown in Fig.
trunk port accordingly, we use the multi-cast messages called 5. Cisco supports two types of ports to connect with devices
bridge protocol data units (BPDUs). This BPDU is considered either to a single or multiple VLANs i.e., trunk port and access
the configuration messages in the VLANs. Root Bridges are port. A Trunk port is usually a link connecting two switches or
responsible to multi-cast the BPDUs to the other switches one router and one switch or two routers forming a backbone
that use a formula to determine which one the needed to of the VLAN, while the access ports are used to connect the
be disabled and which one allowed to forward traffic on to end-users. An attacker usually lies on the access port, wants
the VLAN, as show in Fig. 3. The bridge having the least to access a victim host from the same VLAN but on the other

Authorized licensed use limited to: Sharda University. Downloaded on July 18,2023 at 08:12:17 UTC from IEEE Xplore. Restrictions apply.
 the version of the operating system, hostname, port ID, device
type, duplex setting, virtual trunking protocol (VTP) domain,
the power drawn, source and destination addresses and time-
to-live. However, these frames are highly extensible due to the
use of type-length-value (TLV) format. So, further information
can be added to these announcement frames due to the TLV
features.
Fig. 5: Double tagging VLAN hopping attack To avoid the mis-configuration of dynamic routing pro-
tocols, CDP uses a method of operation called on-demand
TABLE I: Summary of critical security attacks at data link routing. In which CDP announcements provide the routing
layer information on demand. The devices in a corporate network
can update their CDP database from the headers of the packet
Attack Name Description
MAC Attacks A switch is flooded with random MAC address. This received accordingly and new devices can be added to the
(CAM Table makes the switch’s table to become filled. The switch corporate network. However, Cisco devices can’t propagate the
Flooding) is the forced to operate like a hub (i.e. frames are CDP messages. Cisco switches use dynamic trunking protocol
forwarded out to all the ports)
STP Attacks Wrong BPDU frames are sent to switches to change (DTP) that supports four modes of operation, mentioned
the spanning-tree topology. DoS attacks can be above. If a Cisco switch is in the first two modes of operations
launched if the topology is frequently changed. i.e., dynamic desirable and dynamic auto, an attacker will be
CDP Attacks Wrong CDP information is sent to switch or routers
to interfere with their operations.
able to convert an access link into a trunk link. In the first
VLAN Attacks By sending wrong VLAN information to switches, mode of operation, Cisco root routers and switches can send
either i) configurations of networks are changed, or the CDP messages to other devices on a corporate network,
ii) operation of network are severely affected.
DHCP Networks are attacks by interfering DHCP oper-
while the other devices can configure themselves accordingly
ations. Attacks like a man in the middle can be for their connectivity to the network. The information sent
launched. through these messages consist of sender/receiver IP address,
ARP Attacks Networks are attacks by interfering ARP operations. Cisco IOS, software version used in Cisco devices, time to live
In these attacks, network operation can be severely
affected (e.g. a rogue router can become the default a packet, the model number of switches and routers and their
gateway of a network) capabilities, etc. The time-to-live information is used to define
the life of packet in a corporate network. When the routers and
switches are in first two modes of operations, an attacker not
access port, traversing through the trunk port in its way. Cisco only can get the information related to the network but also
switches use the 802.1Q tag enabled on the trunk ports. There can over-flow device’s memory and can potentially crash the
are four states in which Cisco switches can operate, as stated root switches by sending false numerous CDP frames.
below. In the generation and during transmission of CDP frame
• Trunk no authentication is provided. Hence, a false CDP frame can
• Dynamic auto easily be crafted and sent over the network to the connected
• Dynamic desirable devices. If an attacker gets access via Telnet, he can collect the
• No-negotiate CDPs and hence the necessary information of entire topology
Three modes of Cisco switches, trunk, dynamic auto and of the network running at layer 2 and 3. CDP attack scenario
dynamic desirable permit changing an access port into trunk is shown in Fig. 6. This useful information makes him able to
port, while the other mode do not allow an access port to be craft a very effective attack against the network, for instance,
a trunk port. This sort of attack can be performed only in one man-in-the-middle attack [4], [13].
direction while being on the same VLAN, as shown in Fig. 5
E. CAM table overflow attack
of this study.
Now, we are going to briefly discuss the attacks that can CAM stands for content addressable memory (CAM) ta-
affect the development of system-security policy and are the ble that is system memory construct. Ethernet switches are
hot topics for the implementation of basic safety operations. vulnerable to CAM table overflow attack. For instance, Cisco
These attacks are more common as compared to the first ones switches store the MAC addresses, corresponding physical port
mentioned in the earlier sections as given in Table 1 of this and VLAN ID on which end-user is located.
study [14], [16]. Usually, Cisco CAM table is designed to store 100 to 10000
MAC addresses simultaneously. If the new MAC addresses are
D. Cisco Discovery Protocol attack being received continuously at the respective port from client
Cisco discovery protocol (CDP) is a network-independent of a particular corporate network, then it may lead to CAM
and media-independent protocol, enabled by default in the table overflow attack. Each entry remains about 300 seconds
Cisco switches and routers hence, can send the CDP announce- in the CAM table of the ethernet switch. CAM table stores
ments over the corporate network. Cisco switches for their the MAC addresses for the respective port number for each
configuration rely on the CDP announcements that consist of entry made in the CAM table. If an address already exists in

Authorized licensed use limited to: Sharda University. Downloaded on July 18,2023 at 08:12:17 UTC from IEEE Xplore. Restrictions apply.
 Fig. 6: CDP attack [2], [17], [18]

Fig. 8: MAC spoofing attack [10], [16], [17]

the cached entries in the target devices also change upon

receiving a false GARP packet. The whole process of making
a false entry in the ARP cache of a device is called the ARP
poisoning. An attacker can proclaim his access switch as the
default gateway for the corporate network. An attacker uses
ARP poisoning for this purpose, as shown in Fig. 8. The ARP
poisoning enforces all the gateway traffic to pass through the
attacker’s switch. This scenario makes him able to analyze all
the traffic before forwarding to the real gateway device. An
attacker can systematize the necessary changes to the packets
Fig. 7: CAM table over-flow attack [2], [16], [17] which he enforces through his false gateway [17].
G. DHCP starvation attack
the table, then only the time-stamp is updated otherwise new Dynamic host configuration protocol (DHCP) is used for
entry is made in the table for a new address that is a new host configuration in the IP networks to allow communication
connection from the member of a VLAN. among the DHCP server and DHCP clients. The DHCP server
Attackers take advantage of the max size of the CAM table provides the configuration parameters for an IP-network such
and send numerous packets containing false MAC addresses. as default gateway, host IP addresses, lease time for an IP
So, the received number of MAC addresses exceeds the max address and others. A router can also be configured as a
table capacity. In this situation, the switch turns into a hub DHCP server. A DHCP server provides necessary information
and enables the attacker to access every client in a corporate automatically upon the request made from a DHCP client.
network or a virtual local area network (VLAN). Attackers In the DHCP starvation attack, an attacker may send tons of
take the desired exact information of the hosts and the structure false IP addresses assigning requests so that the total capacity
of a local area network (LAN) and perform a man-in-the- of the DHCP server exhausts and DHCP server can’t serve
middle (MITM) attacks more effectively in the corporate the real clients anymore, as shown in Fig. 9 of this work. In
network as shown in Fig. 7 [4], [13], [17]. this situation, an attacker can set a false DHCP server, on the
IP network which sends the DHCP replies to the clients that
F. MAC spoofing attack / ARP poisoning
are not the replies from actual DHCP server but these are the
The address resolution protocol (ARP) is a protocol that manipulated replies from illegal DHCP server [10], [17].
normally works on the network layer, however, MAC address
spoofing is performed on the data link layer. In the spoofing H. Wireless 802.11 (Wi-Fi) attack
process, gratuitous ARP (GARP) packet is sent over the Wi-Fi is an acronym of the ‘wireless fidelity’ to provide
network. The GARP is sent to announce the combination of WLAN services through compatible devices such as Wi-Fi
spoofed MAC and IP addresses. The devices connected to routers. The Wi-Fi networks (WLANs) are easier to establish
the local area network or virtual local area network (VLAN), and maintain as compared to the corporate network consisting
maintain a cache containing the IP addresses and their cor- of ethernet cables. Wi-Fi cards are most of the time built-in
responding MAC addresses for each entry. Because there is on the computers, others can add external cards to have Wi-
no authentication system for received ARP packets, a device Fi network services. While the wired (ethernet) connections
can send false frames containing false MAC addresses. So, require to have the cables to be properly installed. Due to

Authorized licensed use limited to: Sharda University. Downloaded on July 18,2023 at 08:12:17 UTC from IEEE Xplore. Restrictions apply.
 such as unauthorized access to the critical infrastructure of
an organization, company records and even solidarity of a
country.
Focusing on the importance and criticality of network
security issues at data link layer, we have presented a detailed
overview of the security problems related to network layer 2
(data link layer), and briefly consolidated on the techniques
through which a network administrator conceives vulnerabil-
ities that may occur at other layers of OSI model due to the
data link layer. We emphasized on developing a general un-
derstanding of the network security problems at layer 2 of OSI
Fig. 9: DHCP starvation attacks [1], [3], [10]
model. However, the developers and manufacturers are also on
their way to perform their role in the prevention of network
hacks for example techniques developed by the developers to
their simple and less costly installation, an attacker can do the
overcome the CAM overflow attacks is named as the port secu-
following things to the Wi-Fi local area network (WLAN).
rity provided by the Cisco manufacturers. Protection systems
• Easily can put himself between the server and the client
exist to prevent the network security problems such as the host-
• Can do the Denial-of-Service (DoS) attack
based intrusion protection (HIP), firewalls, intrusion protection
• Able to capture all the traffic
systems (IPS), host-based intrusion protection (HIPS) etc. In
Two ways by which an attacker can connect to a Wi-Fi future we will devise a comprehensive framework to counter
LAN, are given in the following. security threats of data link layer.
• Establish a false access point (AP) having higher inten-
R EFERENCES
sity signals than the original one and provide a similar
configuration as the original one have and wait for the [1] A. Annapurna, S. Mohammed, D. Madhuri, Data Link Layer-Security
Issues, International Journal of Computer Science & Engineering Tech-
new clients got connected with it. nology (IJCSET), vol. 4, p. 4, 1009 - 1012.
• De-authenticate the original one or two clients of an AP [2] J. szombat, Hackerek támadták meg az Európai Bizottságot, [Online].
and create a new client having same credentials as the Available: https://www.origo.hu/nagyvilag/20121110-hackerek-tamadtak-
meg-az-europai-bizottsagot-azerbajdzsanban.html.
real AP, so that de-authenticated client got connected with [3] GReAT, The ”Red October” Campaign, 14 January 2013. [Online].
rogue AP. Available: https://securelist.com/the-red-october-campaign/57647/.
[4] Wi-Fi, 2019. [Online]. Available: http://en/Wikipedia.org/wiki/Wi-Fi.
The denial-of-services attack on a Wireless LAN can be [5] M. LAJOS, Az informatikai biztonság egy lehetséges rendszertana, 2008.
formed by the following two possible ways. [6] B. T. B. Risteski, Simulation Analysis of DoS, MITM and CDP Security
Attacks and Countermeasures, Future Access Enablers of Ubiquitous and
• There can be made numerous requests to the wireless
Intelligent Infrastructures, p. 197 - 203, 2015.
LAN that will over-flow the resources of an AP. Hence, [7] Data Link Layer, July 2019. [Online]. Available:
the access point will reject all the original clients’ con- http://www.ee.surrey.ac.uk/Projects/CAL/networks/Data Link Layer.
[8] Hacking Layer 2: Fun with Ethernet switches, Cisco, 2013. [On-
nection request made further. line]. Available: https://www.blackhat.com/presentations/bh-usa-02/bh-
• Many devices are commercially available that can affect us-02-convery-switches.
the operational frequency of AP and the access point will [9] A. O’Keeffe, The difference between Layer 3
and Layer 2 networks, 2019. [Online]. Available:
be unable to provide the services on the same frequency. https://www.aussiebroadband.com.au/blog/difference-layer-3-layer-2-
An eavesdropper can capture all the traffic from an AP if he networks/.
[10] OSI model, Wikipedia, 2019. [Online]. Available:
has simply a wireless network card. An attacker may use the https://en.wikipedia.org/wiki/OSI model.
following two easy steps to capture the network traffic through [11] M. Sanchez, Encyclopedia of Parallel Computing, 2011, p. 12 - 40.
NIC. [12] Spanning Tree Protocol, Cisco, 2019. [Online]. Available:
https://www.cisco.com/c/en/us/tech/lan-switching/spanning-tree-
• Install the wireless network interface card protocol/index.html.
• Put the wireless NIC into monitoring (promiscuous) mode [13] D. F. a. K.-Y. W. Kai-Hau Yeung, Tools for Attacking Layer 2 Network
Infrastructure, 2008.
[4], [18]. [14] VLAN hopping, wikipeida, 2019. [Online]. Available:
https://en.Wikipedia.org/wiki/VLAN hopping.
IV. C ONCLUSION AND FUTURE WORK [15] What is Spanning Tree Protocol (STP), 2019. [Online]. Available:
http://www.omnisecu.com/cisco-certified-network-associate-ccna/what-
Until last decade of the 19th century, traditional networking is-spanning-tree-protocol-stp.php.
consisted of the hubs, switches and ethernet cables. The tech- [16] G. Marro, Attacks at the Data Link Layer, Master thesis, The University
nology of today is based on light waves and electromagnetic of California at Davis, 2003.
[17] IEEE 802.11ax, Wikipedia, 2019. [Online]. Available:
waves for connectivity such as the Wi-Fi 6, rather relying https://en.wikipedia.org/wiki/IEEE 802.11ax
on the ethernet cables [19]. In current era, about 61 percent [18] Wi-Fi 6, tp-link, 2019. [Online]. Available: http://www.tp-
of the employees within an organization have access to the link.com/us/wifi6.
[19] M. S. Y. I. Husameldin, Mitigation of DHCP starvation attack, Com-
Wi-Fi networks in their offices. This ease of access has put puters & Electrical Engineering, vol. 38, no. 5, p. 1115 - 1128, 2012.
our secrecy on risk and has introduced new vulnerabilities

Authorized licensed use limited to: Sharda University. Downloaded on July 18,2023 at 08:12:17 UTC from IEEE Xplore. Restrictions apply.