A MAC address table is a switch data structure that maps learned MAC addresses to the ports through which devices are reachable. When a switch receives a unicast frame, it checks the destination MAC address: a matching entry sends the frame through the specified port; an unknown destination is flooded through every port in the same VLAN except the receiving port. section 12.1.1
The table has a finite capacity. A MAC flooding attack fills it with spoofed addresses, preventing the switch from learning legitimate hosts. Frames destined for those hosts then remain unknown and are flooded, allowing an attacker to receive copies of traffic. DHCP exhaustion can produce the same effect as a side effect of its many spoofed DHCP messages. section 12.1.1
Port Security constrains how the table is populated on individual switch ports:
- Limits the number of unique MAC addresses learned on a port; the default limit is one when Port Security is enabled. section 12.3
- Treats learned addresses on a protected port as secure MAC addresses; static and dynamic secure addresses can coexist. section 12.3
- Forgets dynamically learned addresses, including secure MAC addresses, when the port goes down. section 12.3
Verifying a protected table entry
SW1# show mac address-table secure Vlan Mac Address Type Ports 1 0200.0011.1234 STATIC Fa0/4 1 00e0.423c.f021 STATIC Fa0/5 2 0200.0022.3456 STATIC Fa0/5 Secure MAC addresses appear as STATIC in the MAC address table. Use show port-security interface f0/1 to compare a port’s maximum and total learned addresses, its last source address, and its violation count.
