Spanning tree attacks: the rogue root and Root Guard

Spanning tree elects one root bridge, and every switch builds its paths toward it. A device on an access port sends bridge protocol messages, BPDUs, that claim a better priority.

Out of the box, BPDU Guard and Root Guard are off on all four vendors, and Juniper accepts all BPDUs by default. Nothing in the protocol checks who is speaking.

One access port. No account: the protocol trusts every BPDU it receives.

And on a network where nobody set the root's priority, the number to beat is the default.

The device on the desk announces priority zero. The switches elect it as the new root.

The tree rebuilds around it: some core links go into blocking, and traffic now flows toward the edge. The lowest bridge ID wins, even when it sits on a desk.

Traffic redirected through a port where it can be observed. Core links blocked: Huawei's own example shows a 100 gigabit link blocked while traffic falls back on 10 gigabit links.

And every change of root makes the tree converge again, which interrupts traffic.

On every user port, mark the port as an edge port and turn on BPDU Guard, so a BPDU shuts the port down. On the links toward access switches, turn on Root Guard, so no better root can come from there. Cisco, Huawei, Aruba and Juniper all have both.

Set the priority of your intended root and its backup, so the default is never the bar.

And avoid BPDU filtering: Cisco says it is the same as disabling spanning tree on that port.

NacTrack checks Root Guard on Cisco, Huawei, Aruba and Juniper switches, and shows which switch is the root of each spanning tree.

Sources: Cisco Catalyst 9300 STP guides, Huawei STP guides, Aruba AOS-CX 10.14, Juniper EX STP guide, ANSSI.

Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.