On Fri, 26 Mar 2010 18:09:22 -0400 Chuck Anderson <c...@wpi.edu> wrote:
> Anyone have suggestions on Ethernet LAN loop-prevention? With the > advent of Auto MDI/MDI-X ports on switches, it seems way too easy to > accidentally or maliciously create loops between network jacks. We Some time ago I did some work on implementing what cisco called 'port security'. The idea was to add some layer 2 protection from a security perspective. It turns out in practice, at least in the environment I was in, they never happen. However, it did offer protection for loops since if a secured port saw a source address show up another another port, it would block it and generate logs, which we monitored and could then go deal with while the network remained up. There are some potential gotchas depending on how you implement port security so you need consider carefully how you implement it if you do it. Its been awhile since I've done anything in this space, but this better captures my experience since my memory of it is beginning to fade: <http://www.ops.ietf.org/lists/opsec/opsec.2005/msg00033.html> John
