MAC Flooding: Turning a Switch Into a Hub, and How Port Security Stops It

A switch forwards a frame to one port instead of all of them because it has learned which MAC address lives where. That knowledge is held in a finite table, and MAC flooding fills the table with fabricated entries until the switch can no longer learn anything real — at which point it falls back to flooding, and every device on the segment sees traffic that was not for it.

How the CAM table works

When a frame arrives, the switch records its source MAC address against the ingress port. When a frame needs forwarding, it looks up the destination: a known address goes out one port, an unknown address is flooded out every port in the VLAN.

That flooding behaviour is not a bug — it is how the switch discovers where a silent device is. Entries age out after a few minutes so the table tracks devices that move.

The table is fixed in size, typically thousands to tens of thousands of entries depending on the hardware. An access switch at the low end of that range can be filled quickly.

The attack

The attacker generates a continuous stream of frames with randomly generated source MAC addresses. The switch dutifully learns each one, and within seconds the table is full.

What happens next depends on the switch, and the important case is fail-open: unable to learn new addresses and unable to find existing ones as they age out, the switch floods traffic for unknown destinations out every port. Functionally it has become a hub, and the attacker sees the conversations of every other device in the VLAN.

The flooding is also a performance problem in itself. Every device processes traffic it should never have received, and on a busy segment that is a meaningful load — so the attack doubles as a degradation of service.

It is a same-segment attack: the attacker must be physically or wirelessly on the network, and the flooding is confined to the VLAN. It is also loud, which is what makes it detectable.

Port security

The direct control. Port security limits how many MAC addresses a switch port may learn, and an access port connecting one workstation needs exactly one — or two where an IP phone with a pass-through port is in use.

With a limit of one or two, an attacker generating thousands of addresses violates it immediately and the port reacts. Three violation modes exist, and the difference matters. Protect silently drops frames from unknown addresses. Restrict drops them and logs and counts the violation. Shutdown puts the port into err-disabled state, which is the default and the strongest response.

Shutdown means someone must re-enable the port, so pair it with error-disable recovery on a timer to avoid a support call for every accidental violation — the same recovery handling used for BPDU Guard, and for the same reason.

Sticky MAC learning is the practical middle ground: the switch learns the currently connected address and writes it to the configuration, so the port is bound to that device without anyone typing MAC addresses. Note that sticky entries become stale when hardware is replaced, which is a support burden worth planning for.

The layered position

802.1X is the stronger control, because it authenticates the device before the port carries any traffic at all — an unauthorized machine never gets the opportunity to send its first forged frame. The framework is covered under 802.1X port-based authentication.

VLAN segmentation limits the blast radius: flooding reaches only the attacker's own VLAN, so a smaller segment exposes fewer conversations. Disabling unused ports removes the easy physical entry point.

And assume some interception is always possible. Encryption in transit means an attacker who succeeds in flooding sees metadata rather than content, which is the durable answer — the same layered reasoning as with ARP spoofing, the other classic same-segment interception attack.

Detection

The signature is unmistakable. CAM table utilization rising rapidly toward capacity, an implausible number of MAC addresses learned on a single access port, and a sharp increase in flooded traffic across the segment.

Poll table utilization and per-port MAC counts over SNMP and alert on the rate of change rather than the absolute number. Port security violation events sent to your SIEM are the direct alert where the control is already deployed — a port hitting its limit is a security event, not a networking nuisance.

Exam angles

Know MAC flooding as filling the CAM table with bogus addresses so the switch fails open and floods frames, turning it into a hub and enabling interception. Name port security as the specific mitigation, with the maximum MAC address limit and the protect, restrict and shutdown violation modes. Recognize 802.1X as the stronger preventive control and VLAN segmentation as limiting the scope. Expect a scenario describing unexpected visibility of other hosts' traffic on a switched network.