MAC Flooding
- Overwrite fields in switch
- MAC flooding
Switches maintain a translation table that maps various MAC Addresses to the physical ports on the switch
- As a result, they can intelligently route packets from one host to another
- However, switches have a limited memory
- MAC flooding makes use of this limitation to bombard switches with fake MAC addresses until the switches can no longer keep up
- Once this happens to a switch, it will enter fail-open mode, wherein it starts acting as a hub by broadcasting packets to all the ports on the switch
- It can no longer store new MAC addresses that it learns from incoming frames.
- When a switch receives a frame from a source MAC address that it doesn’t know (i.e., it’s not in the CAM table), and the table is full, the switch will flood the frame out of all ports except the one it came from. Swich is now working as a Hub
- Once that happens, it becomes easy to perform sniffing
MAC flooding is an attack where you spam a network switch with tons of fake MAC addresses until its memory gets full. When the switch runs out of memory, it gets confused and starts sending all traffic to everyone on the network (like shouting in a room instead of whispering to one person). This makes it easy for an attacker to spy on everyone's network traffic because they can now see data meant for other computers.