Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

During network traffic monitoring, a security administrator observes high volumes of unicast traffic being unexpectedly flooded to every physical port on a managed Layer 2 Ethernet switch. Packet analysis reveals that a single connected workstation is transmitting thousands of Ethernet frames per second, each using a unique, randomized source MAC address. As a result, the switch's Content Addressable Memory (CAM) table has become completely full, forcing the switch to broadcast incoming traffic across all ports in the broadcast domain. Which of the following network attacks is indicated by these observed behaviors?

  1. MAC table overflowAnswer
  2. B
    ARP poisoning
  3. C
    VLAN hopping via switch spoofing
  4. D
    Rogue DHCP server deployment

Answer

The attack indicated by these indicators is a MAC table overflow attack.
The correct answer is MAC table overflow. Switches maintain a Content Addressable Memory (CAM) table to map MAC addresses to physical ports. When an attacker floods the network with frames containing randomized source MAC addresses, the CAM table quickly fills up. Once full, the switch can no longer learn new MAC mappings and enters a fail-open state, broadcasting incoming unicast frames out of all ports within the VLAN (acting like a hub), allowing an attacker to intercept traffic.

Step-by-Step Solution

1
Analyze the observed technical indicators from the scenario log.
Identified high-volume Ethernet frame transmission from a single host containing randomized source MAC addresses causing CAM memory exhaustion.
Managed switches store MAC address to port mappings in a fixed-capacity CAM table.
2
Determine the impact on switch behavior when CAM table capacity is exceeded.
The switch fails open and behaves like a network hub, flooding unicast frames out of all ports within the VLAN.
When a destination MAC address is unknown because new entries cannot be learned in a full CAM table, the switch must flood frames to ensure delivery.
3
Map the technical indicators and outcome to the correct network attack classification.
Matched MAC table overflow (MAC flooding) as the specific attack technique.
Attacker tools (such as macof) flood fake MAC addresses specifically to capture traffic across the broadcast domain once the switch fails open.

Key Concept

MAC Table Overflow (MAC Flooding) Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic