SimulatorUnit 3 · Topic 3.1
MAC flooding: fill the switch table and watch it broadcast
Fill a switch table with fake addresses and watch it flood frames.
New to this? Read the topic first: 3.1 Network Vulnerabilities and Attacks.
Simulation · MAC flooding [3.1.A.2, 3.5.E.4, 3.3.B.4]
Simulator: flood a switch's MAC address table
The switch's table holds only 8 entries in this model. Real switches hold thousands, but the idea is the same.
| Vlan | Mac Address | Type | Ports |
|---|---|---|---|
| 1 | 3c52.824a.9f10 | DYNAMIC | Fa0/1 |
| 1 | 5a01.9c44.7b21 | DYNAMIC | Fa0/2 |
| 1 | 0c9d.921a.224e | DYNAMIC | Fa0/3 |
Total Mac Addresses for this criterion: 3 (table limit in this model: 8)
sw-front-02(config)# interface Fa0/4 sw-front-02(config-if)# switchport port-security sw-front-02(config-if)# switchport port-security maximum 1
Read the steps without the simulator
- Normal forwarding. The laptop sends a frame to the file server's MAC address. The switch looks it up in its MAC address table (Fa0/2) and sends the frame only out of that port.
- The flood. The adversary on Fa0/4 sends a stream of Ethernet frames, each with a different fake source MAC address. The switch tries to learn every one, and the table fills up.
- Broadcast mode. Real entries age out of the full table and the switch has no room to relearn them. Frames for addresses it no longer knows go out of every port, so the laptop's next frame to the server also reaches the adversary, who can now eavesdrop.
- Detect and prevent. Defenders spot an unexpected surge of frames with different MAC addresses, and a table full of unfamiliar entries on one port [3.5.E.4]. Port security (switchport port-security maximum 1) limits how many MAC addresses one port may use, so the flood from Fa0/4 is blocked [3.3.B.4].
Go to the topic: 3.1 Network Vulnerabilities and Attacks