Switch Port Security: Sticky MACs & Violations Explained

Switch port security is a Layer 2 feature that restricts input to an interface by limiting the MAC addresses allowed to send traffic. By configuring maximum MAC limits and violation modes like Shutdown, Restrict, or Protect, administrators prevent unauthorized device access and mitigate CAM table overflow attacks on the network.

Why do you need switch port security in a modern network?

Imagine leaving your front door unlocked in a busy city. In networking, an unsecured switch port is exactly that. Without port security, any device can plug into a wall jack and gain access to your VLAN. More dangerously, an attacker can launch a MAC flooding attack, sending thousands of fake MAC addresses to the switch to overflow the Content Addressable Memory (CAM) table.

When the CAM table is full, the switch fails open and starts acting like a hub, broadcasting all incoming frames to every single port. This allows an attacker to use a packet sniffer to capture sensitive data from other users. For the CompTIA Network+ (N10-009) exam, you need to understand that port security is your first line of defense at Layer 2 to prevent this specific vulnerability.

How do you set maximum MAC address limits per port?

The first step in locking down a port is defining the 'maximum' number of MAC addresses allowed. By default, a port allows an unlimited number of addresses, which is a security nightmare. By using the command `switchport port-security maximum [number]`, you tell the switch exactly how many devices are permitted on that physical link.

In a practical scenario, you might set the limit to 1 for a standard workstation. However, if you have a VoIP phone with a PC daisy-chained to it, you'll need a limit of at least 2. If you set this too low, you'll inadvertently lock out legitimate users. We emphasize these real-world configuration nuances in our Cert Sensei practice exams, where we provide 1,000 expert-curated questions to ensure you don't just memorize commands, but understand when to apply them.

What is the difference between Dynamic and Sticky MAC learning?

Learning MAC addresses manually is a tedious process that doesn't scale. This is where Dynamic and Sticky learning come in. Dynamic learning allows the switch to learn the MAC address of the first device that plugs in and store it in RAM. The problem? If the switch reboots, that learned address is gone, and the port is open to whoever plugs in first after the restart.

Sticky MAC learning (`switchport port-security mac-address sticky`) is the professional's choice. It dynamically learns the MAC address but then converts it into a 'sticky' secure MAC address that is added to the running configuration. This means the switch remembers the device even after a reboot (provided you saved the config). It gives you the ease of dynamic learning with the persistence of static configuration, drastically reducing administrative overhead in large office deployments.

Which violation mode should you choose: Shutdown, Restrict, or Protect?

When a device violates the security policy—such as a third device plugging into a port limited to two—the switch must react. You have three primary choices. 'Shutdown' is the default and most aggressive; it puts the port into an 'err-disabled' state immediately. The port stays dead until an administrator manually enters `shutdown` and `no shutdown` to reset it.

'Restrict' is more surgical. It drops packets from the unauthorized MAC, increments the violation counter, and sends an SNMP trap to alert the admin. You get the security of a block and the visibility of an alert without the downtime of a shutdown. Finally, 'Protect' is the quietest mode; it simply drops the unauthorized traffic without sending any notifications or incrementing counters. For the N10-009 exam, remember that Shutdown is the most secure but requires the most manual intervention.

How does port security prevent CAM table overflow attacks?

A CAM table overflow attack works by flooding the switch with thousands of random MAC addresses, forcing the switch to purge legitimate entries to make room for the fake ones. Once the table is exhausted, the switch reverts to 'fail-open' mode, broadcasting all traffic. This is a goldmine for an attacker using a tool like Wireshark.

Switch port security kills this attack at the source. By limiting the maximum number of MAC addresses per port (e.g., to 2 or 3), the switch will simply refuse to learn any more addresses once that limit is reached. The attacker's flood of fake MACs is stopped at the ingress port, and the CAM table remains stable. This ensures that traffic continues to be switched based on known MACs rather than broadcast to the entire network.

How can you effectively practice these concepts for the N10-009 exam?

Reading about port security is one thing; applying it under the pressure of a timer is another. The best way to master this is through a combination of labbing in Packet Tracer and rigorous testing. You need to be able to distinguish between the subtle differences in violation modes and know exactly how sticky MACs behave during a power cycle.

At Cert Sensei, we help you bridge this gap with our premium practice platform. You get access to 1,000 expert-curated Network+ questions with detailed reasoning for every answer. Instead of guessing, you'll understand the 'why' behind the correct choice. Plus, our domain-level analytics show you exactly where you're struggling—whether it's Layer 2 security or IP routing—so you can stop wasting time on what you already know and focus on your weak spots.

❓ Frequently Asked Questions