MACFlooding

MAC flooding is a security vulnerability and attack against network switches, typically in Ethernet LANs. In a switched network, switches learn the association between MAC addresses and switch ports by observing frames. This learning is stored in a limited-capacity table sometimes called the CAM (Content Addressable Memory) table. A MAC flooding attack attempts to exhaust that table by rapidly sending frames with a large number of spoofed source MAC addresses. Once the table is full, the switch can no longer learn new addresses and may be forced to flood frames to all ports in the broadcast domain. As a result, devices that would normally communicate only with specific switch ports may receive traffic they are not intended to see, enabling potential eavesdropping or man-in-the-middle activity.

The attack relies on the presence of a finite CAM table and the switch’s behavior when it cannot make precise forwarding decisions. Even without successful eavesdropping, the flooding effect can degrade performance and disrupt normal communication. MAC flooding is often discussed alongside other layer-2 attacks and is particularly relevant in environments with large numbers of devices or insufficient per-port controls.

Defenses focus on limiting or eliminating the conditions that enable flooding. Common countermeasures include enabling port security features that cap the number of MAC addresses learned per port (sometimes with sticky MAC assignments), disabling unused ports, and segmenting networks with VLANs. Additional protections include 802.1X authentication, DHCP snooping, dynamic ARP inspection, and monitoring for abnormal CAM table growth or port-security violations. Regular auditing of switch configurations and logs also helps detect and mitigate such threats.