What is a MAC flooding attack, and how do you stop it?
Show the answer
Say this first
A switch learns source MACs into its MAC address table, which has a fixed size. The attacker sends a flood of frames with random source MACs until the table is full. New legitimate addresses can no longer be learned, so frames to them are unknown unicast and get flooded out of every port in the VLAN, where the attacker can capture them. The switch behaves like a hub for that traffic. Port security with a small MAC maximum stops it at the edge, and 802.1X keeps unknown devices off the port.
Go deeper
Mechanism in detail
- The table is shared by all VLANs on the switch, so once it is full, learning stops everywhere and unknown unicast flooding rises in every VLAN. The attacker sees only the floods in its own VLAN.
- Existing entries age out (300 seconds by default on Cisco) and cannot be relearned while the table stays full, so more and more traffic gets flooded.
- The switch does not crash. It keeps forwarding, just like a hub for anything it cannot learn.
Mitigation
interface range GigabitEthernet1/0/1 - 46
switchport mode access
switchport port-security maximum 3
switchport port-security violation restrict
switchport port-securityAlso 802.1X so only authenticated devices get a port, and MAC table monitoring.
How you spot it
show mac address-table count shows the table near its platform limit, and
show mac address-table interface Gi1/0/7 shows thousands of addresses on one access port where you
expect one or two. With port security on, the violation log names the port directly.
They will ask next
Why do the extra flooded frames matter if the attacker is in one VLAN?
Traffic between other hosts in the attacker's VLAN, including credentials in clear-text protocols, now reaches the attacker's port. Across the switch, flooding wastes bandwidth on every port.
Would this work against a router?
No. A router forwards on IP and does not flood unknown destinations. The attack is about the layer 2 learning table.
Traps
- Saying the switch crashes or fails closed. It fails open and floods.