A MAC flooding attack fills a switch’s MAC address table with spoofed addresses. Once the table is full, the switch cannot learn legitimate host addresses and floods unknown unicast frames across the VLAN, allowing the attacker to receive copies of traffic. section 12.1.1
The attack depends on normal switch forwarding behavior:
- A matching destination-MAC entry causes selective forwarding through the recorded port. section 12.1.1
- An unknown destination MAC causes flooding through every port in the same VLAN except the receiving port. section 12.1.1
- Thousands of spoofed source addresses fill the table, preventing learning of legitimate devices such as PC1 and R1. section 12.1.1
- DHCP exhaustion and MAC flooding have different goals, but spoofed DHCP DISCOVER messages can cause MAC flooding as a side effect. section 12.1.1
Blocking the attack with basic Port Security
On SW1, configure the affected interface as an access port before enabling Port Security: `interface f0/1`, `switchport mode access`, and `switchport port-security`. By default, the port allows one learned MAC address. A second source address triggers a violation, and the default shutdown action places F0/1 in the Secure-shutdown, error-disabled state. Verify with `show port-security interface f0/1`; inspect recovery with `show errdisable recovery`. Manual recovery uses `shutdown` followed by `no shutdown`, while automatic recovery can be enabled with `errdisable recovery cause psecure-violation`. section 12.1.2 section 12.3
Figure 12.1 A MAC flooding attack. The attacker fills up SW1’s MAC address table with spoofed MAC addresses, preventing SW1 from learning PC1’s and R1’s MAC addresses. As a result, SW1 floods all frames sent between PC1 and R1.
Trace the attack from spoofed frames entering SW1 through MAC-table exhaustion to flooded traffic between PC1 and R1. section 12.1.1
