which method would mitigate a mac address flooding attack

In figure 2 below, host B receives the frame and sends a reply to host A. If the switch cannot find the destination MAC in the MAC address table, the switch then copies the frame and floods (broadcasts) it out of every switch port, except the port where it was received.įigure 1 MAC Address Flooding – Switch Floods Frame for Unknown MAC The switch receives the frames and looks up the destination MAC address in its MAC address table. In figure 1, host A sends traffic to host B. The following figures show how this type of attack works. MAC address table overflow attacks are sometimes referred to as MAC flooding attacks and CAM table overflow attacks. This type of attack is called a MAC address table overflow attack. The MAC address flooding behavior of a switch for unknown addresses can be used to attack a switch. If the destination MAC address does not exist in the MAC address table, the switch floods the frame out of every port on the switch, except the port where the frame was received. If an entry already exists for the destination MAC address, the switch forwards the frame to the correct port. The switch then examines the received destination MAC address and looks in the MAC address table to see if it contains the destination MAC address. As a frame arrives on a switch port, the source MAC address is recorded in the MAC address table. The MAC address table in a switch contains the MAC addresses associated with each physical port and the associated VLAN for each port. Some types of security attacks are described here, but the details of how some of these attacks work are beyond the scope of this course.Īll Catalyst switch models use a MAC address table for Layer 2 switching. The more aware networking professionals within an organization are regarding security attacks and the dangers they pose, the better.

Security is a layered process that is essentially never complete. MAC Address Flooding – Basic switch security does not stop malicious attacks.

With this information an attacker can launch further attacks or even insert a rogue device. By examining downloaded frames, attackers can determine IP addresses of network devices, protocols being used, valid server names and IP addresses, etc. Wired LANs are a common source of attack because so much information can be gained about the wired network using free downloadable tools.

Which method would mitigate a mac address flooding attack