3 ms·
You cannot exploit this in a network which uses non-broken switches - pause frames must not be forwarded to other ports [1]. But vendors who make home switches
by citrin_ru 5y ago
You cannot exploit this in a network which uses non-broken switches - pause frames must not be forwarded to other ports [1].
But vendors who make home switches often ignore standards.
1. https://en.wikipedia.org/wiki/Ethernet_flow_control#Pause_frame https://en.wikipedia.org/wiki/Ethernet_flow_control#Pause_fr...
- xg15 5y agoThanks for the info. This malfunctioning behaviour doesn't seem that uncommon though. Here [1] is another story from 2016 with the same root cause. I'd like to know how widespread that non-standard behaviour really is. I could imagine that many small businesses, e.g. cafes, restaurants etc, use cheap consumer switches to manage their guest wifi. Those would seem to be vulnerable. Another thing: Maybe this is nonsense, but couldn't you spoof PAUSE frames coming from another MAC address than your own, e.g. on wifi? If that's possible, you could disrupt service for selected other network participants even on well-functioning switches (provided you know the victim's MAC address). [1] http://jeffq.com/blog/the-ethernet-pause-frame/ http://jeffq.com/blog/the-ethernet-pause-frame/ HN discussion: https://news.ycombinator.com/item?id=12339902 https://news.ycombinator.com/item?id=12339902
- kcolford 5y agoPAUSE frames are only for the link in question, you should never look at the source address, only the port that the frames were received on