MAC Flooding

Last Updated on Tue, 10 Oct 2023 | Network Security

Table 3-16 shows the summary information for the MAC flooding attack.

Table 3-16. MAC Flooding

Recommended Books

  • Network Security Fundamentals
  • Network Security: A Beginner's Guide
  • Network Security: Principles and Practices
  • Network Security: An Introduction
  • Network Security: A Comprehensive Guide
  • Network Security: A Practical Guide

Related Posts

Readers' Questions

  • Serena
    How does mac address flooding cause a vulnerability in the network?
    10 months ago
    • Mac address flooding is a type of attack where an attacker sends large amounts of fake MAC addresses to a switch in order to overwhelm the switch’s address table. This can cause the switch to stop forwarding all traffic, causing a denial of service attack. It can also cause the switch to start forwarding all traffic to the attacker, making it possible for them to intercept and alter data on the network.

    Disclosure: Some of the links above are affiliate links. This means that, at zero cost to you, I will earn an affiliate commission if you click through the link and finalize a purchase.

    Attack name

    MAC flooding

    Class/subclass

    Flood

    Sample implementations

    macof

    Prerequisites

    Local LAN access

    Pertinent vulnerability

    Policy

    Typical use

    Fill a switch's CAM table and then sniff the legitimate traffic that floods as a result

    Attack result

    Disclosure of information

    Likely follow-up attack

    Read and manipulate

    OSI layers

    2

    Detection

    Switch monitoring (CAM table size)

    Protection

    Port security

    Detection difficulty

    3

    Ease of use

    5

    Frequency

    1

    Impact

    3

    Overall rating

    28

    MAC flooding refers to sending packets with spoofed source and destination MAC addresses from the attacker's system to the Ethernet network. The CAM table, which keeps track of MAC address locations on a switch, has a limited size. If that table is filled, frames destined to MAC addresses without a CAM entry are flooded on the local VLAN to ensure delivery to the correct host. This allows the attacker to sniff those frames just as if the attacker were on a shared, rather than switched, Ethernet segment. The "MAC Flooding Considerations" section of Chapter 6 goes into great detail on CAM tables, the MAC flooding attack, and using port security to block the attack.

    Continue reading here: Figure 311 Smurf Attack

    Was this article helpful?

    +1 0