一、基礎網絡配置

1. 路由器R1配置

interface GigabitEthernet0/0/0ip address 192.1.2.254 255.255.255.0
!
interface GigabitEthernet0/0/1ip address 192.1.3.254 255.255.255.0
!
router rip 1version 2network 192.1.2.0network 192.1.3.0

2. 路由器R2配置

interface GigabitEthernet0/0/0ip address 192.1.3.253 255.255.255.0
!
interface GigabitEthernet0/0/1ip address 192.1.4.254 255.255.255.0
!
router rip 1version 2network 192.1.3.0network 192.1.4.0

3. 路由器R3配置

interface GigabitEthernet0/0/0ip address 192.1.4.253 255.255.255.0
!
interface GigabitEthernet0/0/1ip address 192.1.5.254 255.255.255.0
!
router rip 1version 2network 192.1.4.0network 192.1.5.0

驗證通信

PC> ping 192.1.5.2  # 應獲得100%成功率

二、路由欺騙攻擊實施

入侵路由器配置

interface GigabitEthernet0/0/0ip address 192.1.3.252 255.255.255.0
!
router rip 1version 2network 192.1.3.0

攻擊特征

• 發送偽造路由更新：192.1.5.0/24?metric=1
• 通過Wireshark抓包可見惡意RIP響應：

  Source: 192.1.3.252
  Destination: 224.0.0.9
  RIP Response:- 192.1.5.0/24 Metric=1

路由表污染驗證

R1# show ip route
RIP  192.1.5.0/24 [120/1] via 192.1.3.252  # 正確路由應顯示metric=2

三、安全防御配置

R1/R2接口認證配置

! R1配置
interface GigabitEthernet0/0/1rip authentication-mode hmac-sha256 cipher your_passwordrip version 2 multicast! R2配置
interface GigabitEthernet0/0/0rip authentication-mode hmac-sha256 cipher your_passwordrip version 2 multicastinterface GigabitEthernet0/0/1rip authentication-mode hmac-sha256 cipher your_passwordrip version 2 multicast

防御效果驗證

1. 路由表恢復正確：

   RIP  192.1.5.0/24 [120/2] via 192.1.3.253

2. Wireshark抓包顯示認證字段：

   RIP Authentication:Type: HMAC-SHA256Key-ID: 100

實驗結論

1. RIP協議存在明文傳輸路由信息的安全缺陷
2. 通過偽造metric值可實施路由欺騙
3. 啟用HMAC-SHA256認證能有效防御路由欺騙
4. 建議生產網絡使用OSPF等更安全的路由協議