A security analyst is investigating anomalous network activity within a corporate VLAN. Systems on the subnet experience intermittent latency, and central syslog feeds capture repeated notifications from the primary switch indicating rapid MAC address movement (flapping) for the default gateway across several access ports. Concurrently, network packet captures reveal that the switch has entered a fail-open state, broadcasting unicast frames meant for specific internal servers out of all physical ports on the VLAN. Which of the following attacks is MOST likely occurring?
- MAC Flooding attackAnswer
- BARP Poisoning attack
- CRogue DHCP Server attack
- DDNS Cache Poisoning attack
Answer
The MAC Flooding attack is the correct answer because filling the switch CAM table forces the device into fail-open mode, resulting in unicast traffic flooding and MAC flapping indicators.
The correct answer is MAC Flooding because floods of fake MAC addresses exhaust the switch memory buffer (CAM table). Once full, the switch transitions to a hub-like operational mode (fail-open), forwarding all incoming unicast packets out to every port, which generates MAC flapping alerts for legitimate MAC addresses as bogus frames overwrite table slots.
Step-by-Step Solution
Key Concept
MAC Flooding / CAM Table Overflow Attack Indicators