First-Hop Redundancy Protocols (HSRP/VRRP)¶

HSRP and VRRP decide which router owns the default gateway by comparing a priority number anyone on the segment can announce. Claim a higher one and the gateway is the attacker’s, and everyone who trusts it now routes their way out through it. HSRP defaults to plaintext authentication; VRRP carries none in the standard at all, though some vendors add plaintext or MD5 of their own.

Attack tree for HSRP¶

1. Compromise HSRP Group (OR)

    1.1. Spoof HSRP Messages (OR)

        1.1.1. Forge Hello Packets (Take Over Active Router Role)

        1.1.2. Modify Priority/Preemption Values

    1.2. Exploit Weak Authentication (OR)

        1.2.1. Crack Plaintext/MD5 Authentication

        1.2.2. Bypass Authentication (If None Configured)

    1.3. Cause Failover Disruption (OR)

        1.3.1. Trigger Unnecessary Active-Standby Switches (DoS)

        1.3.2. Send Fake Resign Messages (Force Role Changes)

2. Man-in-the-Middle (MITM) Attacks (AND)

    2.1. Redirect Traffic via HSRP Takeover (AND)

        2.1.1. Become Active Router (Required)

        2.1.2. Intercept/Modify Traffic (Required)

3. Denial-of-Service (DoS) (OR)

    3.1. Flood HSRP Groups (OR)

        3.1.1. Send Excessive Hellos (Disrupt Election)

        3.1.2. Advertise Invalid Virtual IPs (Confusion Attack)

Attack tree for VRRP¶

1. Compromise VRRP Group (OR)

    1.1. Spoof VRRP Advertisements (OR)

        1.1.1. Forge Master Router Advertisements

        1.1.2. Manipulate Priority Values

    1.2. Exploit Authentication Weaknesses (OR)

        1.2.1. Crack Simple Text/MD5 Authentication

        1.2.2. Exploit No Authentication (Absent From The VRRP Standard)

    1.3. Disrupt Failover (OR)

        1.3.1. Force Unnecessary Master-Backup Transitions

        1.3.2. Send Fake Shutdown Events

2. Traffic Interception (AND)

    2.1. MITM via VRRP Takeover (AND)

        2.1.1. Become Master Router (Required)

        2.1.2. Redirect Traffic to Attacker Node (Required)

3. Denial-of-Service (OR)

    3.1. Flood VRRP Groups (OR)

        3.1.1. Overwhelm with Advertisements (Prevent Election)

        3.1.2. Advertise Conflicting Virtual IPs

Key differences¶

HSRP (Cisco proprietary) sends hellos over UDP port 1985 to multicast 224.0.0.2 with TTL 1. Default authentication is plaintext.

VRRP (IETF standard) uses IP protocol 112 to multicast 224.0.0.18. Authentication was already removed from the standard in VRRPv2 (RFC 3768), and VRRPv3 (RFC 5798) adds IPv6 while carrying none either. What stands in its place is the requirement to send with TTL or hop limit 255 and check it on receipt, plus link-local multicast scope, both of which keep the claim on the segment rather than making it harder to forge.

Notes¶

Priority spoofing: setting a higher priority value is the common path to becoming the active or master router.
Authentication bypass: weak or absent authentication allows injection of malicious packets without credential recovery.
Failover abuse: forcing unnecessary role transitions causes instability and may mask other activity on the segment.