This session focuses on the security issues surrounding Layer 2, the data-link layer. With a significant percentage of network attacks originating inside the corporate firewall, exploring this soft underbelly of data networking is critical for any secure network design. Security issues addressed in this session include ARP spoofing, MAC flooding, VLAN hopping, DHCP attacks, and Spanning Tree Protocol concerns. Common myths about Ethernet switch security are confirmed or debunked, and specific security lockdown recommendations are given. Attack mitigation options include the new DHCP snooping and Dynamic ARP Inspection (DAI) functionality. Attendees can expect to learn Layer 2 design considerations from a security perspective and mitigation techniques for Layer 2 attacks.