ISSUES OF PROTECTING STP AGAINST ATTACKS USING THE ROOT GUARD MECHANISM ON ACCESS/DISTRIBUTION LAYER SWITCHES

The article examines the problem of protecting the data link layer of a corporate network against attacks aimed at spoofing the root bridge in STP and RSTP protocols. The relevance of the study is determined by the fact that, without additional protection mechanisms, an attacker with access to a switch port can send forged BPDU packets with a higher priority and trigger an unauthorized topology change. This may lead to spanning tree recalculation, temporary loss of connectivity, and conditions for traffic interception or disruption. The purpose of the study is to experimentally evaluate the effectiveness of the Root Guard mechanism in a heterogeneous network infrastructure based on Cisco Catalyst 2960, MikroTik, and Eltex MES1428 switches. During the experiment, an attack was simulated using the Yersinia tool, the network behavior with disabled and enabled protection was compared, and vendor-specific differences in Root Guard configuration and diagnostics were analyzed. The results showed that, without protection, the attacking host successfully became the root bridge in all tested scenarios, causing instability in the network topology. After Root Guard was enabled, forged superior BPDU packets were blocked, and protected ports were placed into a blocking state, preventing unauthorized Root Bridge changes. The study concludes that Root Guard is an effective mechanism for protecting L2 topology, but its correct use requires consideration of vendor-specific implementation features and proper security event monitoring.