#Which method would mitigate a mac address flooding attack full

When the MAC address table is full of fake MAC addresses, the switch enters into what is known as fail-open mode. The switch updates the MAC address table with the information in the fake frames. MAC flooding attacks make use of this limitation to overwhelm the switch with fake source MAC addresses until the switch MAC address table is full.Īs shown in figure 4, an attacker at host C can send frames with fake, randomly-generated source and destination MAC addresses to the switch. Host C also receives the frame from host A to host B, but because the destination MAC address of that frame is host B, host C drops that frame.įigure 2 MAC Address Flooding – Switch Records MAC AddressĪs shown in figure 3 below, any frame sent by host A (or any other host) to host B is forwarded to port 2 of the switch and not broadcasted out every port.įigure 3 MAC Address Flooding – Switch Uses MAC Address Table to Forward Traffic The switch then learns that the MAC address for host B is located on port 2 and records that information into the MAC address table. In figure 2 below, host B receives the frame and sends a reply to host A. If the switch cannot find the destination MAC in the MAC address table, the switch then copies the frame and floods (broadcasts) it out of every switch port, except the port where it was received.įigure 1 MAC Address Flooding – Switch Floods Frame for Unknown MAC The switch receives the frames and looks up the destination MAC address in its MAC address table.

In figure 1, host A sends traffic to host B. The following figures show how this type of attack works. MAC address table overflow attacks are sometimes referred to as MAC flooding attacks and CAM table overflow attacks. This type of attack is called a MAC address table overflow attack. The MAC address flooding behavior of a switch for unknown addresses can be used to attack a switch. If the destination MAC address does not exist in the MAC address table, the switch floods the frame out of every port on the switch, except the port where the frame was received. If an entry already exists for the destination MAC address, the switch forwards the frame to the correct port. The switch then examines the received destination MAC address and looks in the MAC address table to see if it contains the destination MAC address.

As a frame arrives on a switch port, the source MAC address is recorded in the MAC address table. The MAC address table in a switch contains the MAC addresses associated with each physical port and the associated VLAN for each port. Some types of security attacks are described here, but the details of how some of these attacks work are beyond the scope of this course.Īll Catalyst switch models use a MAC address table for Layer 2 switching. The more aware networking professionals within an organization are regarding security attacks and the dangers they pose, the better.

Security is a layered process that is essentially never complete. MAC Address Flooding – Basic switch security does not stop malicious attacks. With this information an attacker can launch further attacks or even insert a rogue device. By examining downloaded frames, attackers can determine IP addresses of network devices, protocols being used, valid server names and IP addresses, etc.

#Which method would mitigate a mac address flooding attack free

Wired LANs are a common source of attack because so much information can be gained about the wired network using free downloadable tools.