Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

A network administrator discovers that a managed switch has begun flooding unicast frames out of all physical ports within a specific VLAN, causing the switch to degrade to hub-like behavior. Packet captures reveal a high volume of traffic originating from a single host port, containing randomized, rapidly changing source MAC addresses that exhaust the switch's Content Addressable Memory (CAM) table capacity. Which of the following attack types is taking place?

  1. MAC floodingAnswer
  2. B
    ARP poisoning
  3. C
    DNS cache poisoning
  4. D
    SYN flooding

Answer

MAC flooding
MAC flooding involves generating thousands of valid frames with unique, spoofed source MAC addresses from a single host port. This exhausts the limited memory capacity of the switch's Content Addressable Memory (CAM) table. Once full, the switch enters a fail-open state and floods all subsequent unicast frames out of every port in the VLAN, enabling an attacker to capture traffic intended for other nodes.

Step-by-Step Solution

1
Analyze the observed network symptom.
The switch is sending unicast frames out of all ports in the VLAN and exhibiting hub-like behavior.
This occurs when a switch's CAM table is completely full and cannot map unknown destination MAC addresses to specific egress ports.
2
Examine the packet capture traffic pattern.
A high volume of frames with randomized source MAC addresses originates from a single physical port.
Rapidly injecting fake source MAC addresses forces the CAM table to overwrite legitimate entries until its memory limit is reached.
3
Correlate symptoms and traffic patterns with standard attack definitions.
The attack mechanism matches MAC flooding (CAM table overflow).
MAC flooding explicitly targets the Layer 2 switch CAM table capacity to intercept broadcasted unicast traffic.

Key Concept

MAC Flooding and CAM Table Exhaustion
Estimated Time:1m 30s
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic