SA Blanca - SISR, 2025 session

Mission A1 - Analysis and immediate response

The firmware stores the MAC address table (CAM table) in RAM of limited size. The flashing orange port LEDs, combined with the general slowdown, indicate that this table is saturated: the switch can no longer properly learn or associate MAC addresses. No longer knowing which port to forward a frame to, it switches to fail-open mode and floods every frame out of all ports (hub behaviour). Hence the extreme slowdown.

a) On the packet capture from workstation 192.168.10.86, frames destined for IP/MAC addresses other than its own should not appear. Under normal switching, a workstation only receives its unicast frames plus broadcasts. Their presence proves that the switch is flooding all traffic (MAC table saturated).

b) The MAC address table is saturated with illegitimate entries: a single port has learned an abnormally high number of MAC addresses (thousands of spoofed source MACs). Out of memory, the switch no longer switches → it broadcasts.

c) The other switches also receive this stream of flooded frames, spreading saturation and slowdown across the entire VLAN 10 (a snowball effect on the core and distribution layers).

a) GDPR risk: NAS server 192.168.10.243 hosts personal data (clients and users). In flooding mode, frames to and from the NAS are broadcast to all workstations → an attacker (or any workstation) can capture them: this breaches personal data confidentiality (failure to comply with the security obligation under Article 32 of the GDPR).

b) Architectural change: isolate servers in a dedicated VLAN (server VLAN), separate from workstation VLAN 10, with inter-VLAN filtering on the core (C1/C2) or internal firewall. This ensures workstation-side saturation no longer exposes server traffic, and NAS access is controlled.

P2 priority is no longer appropriate: operations across the entire organisation are now blocked (maximum impact, maximum urgency). It must be reassessed as P1 (critical priority).

Restart (or physically isolate) the faulty switch: this clears the saturated MAC table and restores normal switching, at least temporarily. Blocker resolved: as the management interface is inaccessible, physical action is taken (cabinet emergency stop switch) rather than configuration changes.

Mission A2 - Investigating the causes

This is MAC flooding (MAC table flooding). The symptoms - CAM table saturation, failover to hub mode, widespread slowdown - are the hallmark of MAC flooding. ARP spoofing would target specific hosts (ARP cache poisoning) without saturating the MAC table or slowing down the entire network.

By analysing the statistics for the number of MAC addresses per port, we identify the port showing an abnormally high number of MAC addresses: this is where the device generating thousands of spoofed MACs is plugged in.

MAC flooding is a denial-of-service attack (saturation → lockout) combined with an interception/eavesdropping objective: by forcing the switch to flood, the attacker can capture (sniff) traffic not normally destined for their port.

Mission A3 - Remediation

a) Port security provides a partial solution: it limits the number of authorised MAC addresses per port → it prevents flooding. But on its own, it does not cover the required detection/traceability and alerting needs (knowing when and where the incident reoccurs).

b) The most appropriate response to a violation is shutdown (disabling the offending port): it immediately isolates and neutralises the attacking device (as requested by the manager), while logging the event. (The restrict mode would log without cutting the connection, but the exam paper requires isolation.)

a) An SNMP trap is more suitable than active monitoring (periodic polling) because it is sent immediately by the switch at the time of the violation: the alert is real-time, without waiting for the next polling cycle (which would delay detection).

b) SNMPv3 secures monitoring via authPriv mode:

• user authentication (username + password hash, e.g. SHA) → guarantees origin;
• message encryption (e.g. AES) → guarantees confidentiality.

Unlike SNMP v1/v2c (community string in plaintext), v3 therefore protects authentication, integrity and confidentiality of communications.

To verify that the switch now resists MAC flooding, the attack is replayed in a controlled way with macof (MAC address flooding tool): if port security is enabled, the port enters violation/shutdown mode instead of flooding.

Mission B1 - Justifying the solution

The internal Wi-Fi relies on an SSID + shared password: anyone who knows this password can access the internal network (not just the Internet). Unmet security criteria:

• Confidentiality: a visitor or occasional learner can reach internal resources (servers, NAS);
• Integrity: ability to modify or alter data from this access point;
• Availability: a rogue connected device can disrupt the network (e.g. the previous MAC flooding attack).

1. It isolates occasional learners from the internal network: they only get Internet access, not access to company resources.
2. It ensures traceability and accountability: sign-up + accepting the Terms of Use → each access is identified.

Connecting guest Wi-Fi directly to the internal firewall (rather than the core network) allows all of its traffic to be filtered and isolated: it cannot reach internal VLANs, and only explicitly authorised traffic (Internet) is allowed.

Mission B2 - Implementing the captive portal

Requested data	Relevant?	Justified processing
Work phone	Yes	B (sales contact)
Personal phone	No (minimisation)	none
Role / department / employment type	Yes	C (training statistics)
Training completed	Yes	C (correlation with training)

GDPR principle: minimisation - only collect what is necessary for processing (the personal phone is not justified by any of processing activities A/B/C).

On the internal firewall's guest Wi-Fi interface, redirect HTTP (80) and HTTPS (443) traffic from unauthenticated users to the captive portal authentication page:

# Source : réseau Wi-Fi invité | utilisateur NON authentifié
Redirection  src=WiFi_Invité  dport=80,443  ->  Portail_captif (page d'auth)

'Deny all by default' policy, then allow based on authentication:

# 1. Utilisateur AUTHENTIFIÉ : accès Internet web autorisé
Autoriser  src=WiFi_Invité(authentifié)  dst=Internet  proto=HTTP,HTTPS
# 2. Utilisateur NON authentifié : seule la redirection portail est permise
Autoriser  src=WiFi_Invité(non-auth)     dst=Portail_captif
# 3. Tout le reste (vers les VLAN internes notamment) : interdit
Interdire  src=WiFi_Invité  dst=any