Concepts / Switches and VLANs

Switches and VLANs

MAC flooding

Also called CAM table overflow, macof, port security

Filling a switch's MAC table with made-up addresses so that it floods everyone's frames to every port.

A MAC table has a fixed size. An attacker sends frames from thousands of invented source addresses (macof does it); once the table is full, the switch cannot learn where real devices are, so it floods their frames, and the attacker reads traffic meant for others, as on a hub. The defence is port security: a limit on how many MAC addresses one port may teach the switch, beyond which the port drops them or shuts down.

See it on real machines

Learn it on real machines.

Every lab is a small network of real Linux machines in your browser. Start with a free account: Google or email, no card.

Start this lab, free