yersinia

Start interactive ncurses mode

$ sudo yersinia -I

$ sudo yersinia -G

$ sudo yersinia dhcp -attack 1 -interface [eth0]

$ sudo yersinia stp -attack 4 -interface [eth0]

$ sudo yersinia dtp -attack 1 -interface [eth0]

$ sudo yersinia cdp -attack 1 -interface [eth0]

$ sudo yersinia -D

yersinia [-hVGID] [protocol] [-attack attack] [options]

yersinia is a framework for performing Layer 2 network attacks. It exploits weaknesses in network protocols that operate at the data link layer, which are often overlooked in security assessments.
The tool supports multiple attack modes: interactive ncurses console (-I), GTK graphical interface (-G), network daemon (-D), and direct command-line execution. Interactive mode displays protocol fields and available attacks with indicators for which are DoS attacks.
Common attacks include DHCP starvation (exhausting IP pools), STP root bridge claiming (traffic interception), DTP trunk negotiation (VLAN access), and CDP flooding (switch table overflow). These attacks can disrupt network operations or enable man-in-the-middle positions.

-h, --help

Display help

Show version

Start GTK graphical interface

Start ncurses interactive mode

Start as network daemon (telnet server on port 12000)

Execute attack without interactive mode

Network interface to use

Log output to file

Read packets from pcap file

Write packets to pcap file

Attack number to execute

stp

Spanning Tree Protocol attacks

VLAN Trunking Protocol attacks

Dynamic Trunking Protocol attacks

Hot Standby Router Protocol attacks

DHCP starvation and rogue server attacks

Cisco Discovery Protocol attacks

802.1Q VLAN hopping attacks

Inter-Switch Link Protocol attacks

Layer 2 attacks can severely disrupt network operations. Some attacks are denial-of-service and will cause network instability. Only use on networks you own or have explicit authorization to test. Requires root privileges. Many attacks only work on local network segments. Modern switches may have protections against some attacks.

Yersinia was developed by David Barroso and Alfredo Andres as a research tool to demonstrate Layer 2 vulnerabilities. The name refers to *Yersinia pestis*, the bacterium causing plague, reflecting how these attacks can spread through a network. The tool highlighted that network security must address all OSI layers, not just application-layer threats. It became a standard tool for network penetration testing.

ettercap(8), arpspoof(8), macchanger(1), tcpdump(8)