you NEED to learn Port Security…….RIGHT NOW!! // FREE CCNA // EP 14

Exposed Ethernet ports are an easy entry point for attackers because a plug-in device can often obtain network settings via DHCP and then scan or probe the LAN. A key example is the Shark Jack from Hack 5: once connected to an active switch port, it requests an IP address through DHCP, learns the subnet mask, default gateway, and DNS details, and then runs an automated reconnaissance step (in this case an nmap scan) to gather information about reachable hosts and open ports. The practical takeaway is blunt: leaving switch ports “available” can turn everyday infrastructure into a remote foothold—especially in places like offices, airports, and even homes.

The defense starts with reducing what an attacker can use. Unused ports should be shut down at the switch level so they can’t come up even if someone plugs in a device. On Cisco switches, the workflow is to identify down interfaces with commands like “show ip interface brief” and then administratively disable specific ports using “configure terminal,” “interface fastethernet …,” and the “shutdown” command. The video also recommends a “black hole” approach for ports that must remain physically available: isolate them into a dedicated VLAN (a “black hole VLAN”) that has no DHCP server and no default gateway, so devices plugged into those ports can’t reach other parts of the network. In the Cisco example, VLAN 6666 is created and specific FastEthernet ports are assigned to it with “switchport access vlan 666,” effectively trapping any unauthorized device.

But even shutting down unused ports doesn’t solve the scenario where an attacker unplugs a legitimate device and plugs in their own for a moment. That’s where port security comes in. Port security uses Layer 2 MAC address learning to enforce an allowlist per switch port: the switch records which MAC address is permitted, and if a different MAC appears, the port can be shut down or traffic can be restricted. On Cisco, the configuration sequence includes setting the port as an access port (“switchport mode access”), enabling port security (“switchport port-security”), setting the maximum number of allowed MACs (“switchport port-security maximum 1”), and defining the allowed MAC behavior—either explicitly via “mac-address …” or implicitly via “sticky,” which learns the first connected device’s MAC and locks it in. The violation action (“switchport port-security violation shutdown” by default in the example) determines what happens when an unauthorized MAC shows up.

A live demonstration shows the consequence: after enabling port security on a specific GigabitEthernet interface, plugging in a different device triggers a security violation, and the switch places the port into an error-disabled state. Recovery requires administrative intervention—shutting the interface and bringing it back up with “shutdown” followed by “no shutdown,” after which the port returns to normal operation.

Finally, the video places port security in a broader enterprise context. It notes that stronger alternatives exist, including 802.1X authentication (login-based access), certificate-based device authentication, and automated profiling systems such as Cisco ICE. The overall message is a layered defense: disable or black-hole unused ports, and for active ports, prevent MAC spoofing and unplug-and-replug attacks with port security (or stronger identity-based controls).