Cisco 2960

Cisco, Eltex, and MikroTik Switches Tested Against 90 DHCP Spoofing Attacks

Researchers conducted a detailed comparison of three popular network switches to evaluate their effectiveness in blocking DHCP spoofing attacks, a common Layer 2 threat that can compromise data in local networks. The tested devices included the Cisco 2960 with hardware-based protections, the Russian Eltex MES1428 also featuring ASIC-implemented security, and the more affordable MikroTik CRS that relies on CPU-processed Bridge Filter rules. Using a legitimate ALT Linux DHCP server, a Kali Linux attacker running a custom Scapy Python script, and a victim machine, the team launched 30 attacks per device with protections enabled. Results showed Cisco blocking 100% of attacks with the fastest detection times around 415 ms and minimal CPU impact, while Eltex achieved 93.3% effectiveness and MikroTik only 80% with significantly higher latency and processor load. The study highlights hardware versus software implementation differences and provides recommendations for critical infrastructure versus small office environments.