During a network security monitoring session, an analyst receives alerts indicating that an enterprise layer 2 switch is broadcasting unicast frames meant for a specific server out of all active switch ports. Inspection of the switch switchport log shows a single interface generating thousands of inbound Ethernet frames per second, each containing unique, rapidly changing source MAC addresses. Which of the following network attacks is taking place?
- MAC flooding designed to overflow the switch CAM table and force traffic to fail open like a hubAnswer
- BARP cache poisoning intended to corrupt the default gateway mapping on local endpoint ARP tables
- CVLAN hopping utilizing double tagging to bypass VLAN trunking security boundary configurations
- DDNS spoofing attempting to redirect client web traffic to an unauthorized external IP address
Answer
The attack taking place is MAC flooding designed to overflow the switch CAM table and force traffic to fail open like a hub.
The correct answer identifies MAC flooding. In a MAC flooding attack, an adversary sends a massive volume of Ethernet frames with randomized source MAC addresses to a switch port. This rapidly exhausts the finite storage space in the switch Content Addressable Memory (CAM) table. Once full, the switch can no longer store valid MAC-to-port mappings and reverts to a fail-open mode, broadcasting all incoming unicast frames out of every active port, which allows the attacker to capture traffic intended for other endpoints.
Step-by-Step Solution
Key Concept
MAC Flooding and Switch Fail-Open Behavior