MAC Flooding & CAM Table Exhaustion: Network+ Guide

MAC flooding is a Layer 2 attack where an adversary floods a switch's CAM table with fake MAC addresses. Once the table is full, the switch fails-open and acts like a hub, broadcasting all traffic to every port, allowing the attacker to sniff sensitive data using a packet analyzer.

What exactly is a MAC Flooding attack?

Think of a network switch as a smart librarian. To keep traffic efficient, the switch maintains a Content Addressable Memory (CAM) table, which maps specific MAC addresses to the physical ports they are connected to. When a frame arrives, the switch looks at the destination MAC, checks the CAM table, and sends the data only to the intended recipient. It's a precise, private conversation.

In a MAC flooding attack, the attacker disrupts this process by using a tool (like macof) to blast the switch with thousands of frames, each containing a fake, randomly generated source MAC address. The switch, trying to be helpful, dutifully records every one of these fake addresses in its CAM table. Because the CAM table has a finite amount of memory, it quickly fills up with garbage data, leaving no room for legitimate device mappings.

How does CAM table exhaustion impact switch behavior?

Once the CAM table hits 100% capacity, the switch enters a state of 'exhaustion.' At this point, the switch can no longer learn new MAC addresses or maintain the mappings for existing devices. This creates a critical failure in the switch's logic: if it receives a frame for a destination that isn't in its table, it doesn't know where to send it.

To ensure the data still reaches its destination, the switch reverts to a basic fallback mechanism known as 'fail-open' mode. Instead of intelligently routing the frame to a single port, the switch begins broadcasting every single frame to every single port on the VLAN. Essentially, your high-performance managed switch has just been downgraded to a 'dumb' hub.

Why is the 'fail-open' state so dangerous for security?

For most users, a switch acting like a hub just looks like a slight dip in performance. But for an attacker, this is the jackpot. In a normal switching environment, an attacker can only see traffic destined for their own machine or broadcast traffic. Once the switch is flooding all frames to all ports, the attacker can simply run a packet sniffer like Wireshark to capture everything passing through the switch.

This allows the adversary to intercept sensitive data that was never meant for them, including unencrypted passwords, session tokens, and private emails. The attack doesn't crash the network—which would alert administrators—it quietly turns the network into an open book, making it a stealthy and highly effective method for data exfiltration.

How can you mitigate MAC flooding using port security?

The best way to stop this is by implementing port security. Instead of letting a port learn an infinite number of MAC addresses, you can set a hard limit. For example, if you know only one workstation is connected to a port, you can limit that port to a maximum of one or two MAC addresses. If a third MAC address appears, the switch triggers a violation.

Depending on your configuration, the switch can handle this violation in three ways: 'protect' (drops packets from unknown MACs), 'restrict' (drops packets and logs an SNMP trap), or 'shutdown' (completely disables the port). I recommend 'shutdown' for high-security environments, as it forces an admin to investigate the port before it can be brought back online, effectively killing the attack in its tracks.

What are the broader implications for Network+ candidates?

For the CompTIA Network+ (N10-009) exam, you need to understand that MAC flooding is a Layer 2 attack. You'll often see questions that ask you to distinguish between this and MAC spoofing (where an attacker pretends to be one specific device) or ARP poisoning (which manipulates the ARP cache). Understanding the transition from switching to hub-like behavior is a key conceptual hurdle in the security domain.

Mastering these nuances is where many students struggle. That's why we built Cert Sensei to provide 1,000 expert-curated CompTIA Network+ (N10-009) practice questions. We don't just tell you if you're wrong; we provide detailed expert reasoning for every answer and domain-level analytics so you can stop guessing and start knowing exactly where your knowledge gaps are.

❓ Frequently Asked Questions