thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

MAC Flooding

Overwhelming a switch's MAC address table with fake entries so it floods frames to all ports like a hub.

Definition

When the CAM table is full, the switch can no longer learn addresses and broadcasts unknown unicast frames out every port, letting the attacker sniff traffic. Tools such as macof generate thousands of random MAC addresses per second. Port security limiting MACs per port mitigates it.

Example

Running macof on an access port to fill the CAM table and capture other users' traffic.

Exam tip

Port security is the mitigation answer for MAC flooding.

Related terms