A Security Operations Center (SOC) analyst investigates alerts from a managed network switch. The syslog outputs reveal that a single switch port learned over 100,000 unique source MAC addresses in less than one minute. Subsequent packet analysis shows that unicast traffic intended for specific hosts on VLAN 10 is now being broadcast to all physical ports on the switch, allowing an unauthorized system to capture unencrypted data frames. Which of the following attack types is indicated by these log entries, and what primary operational state change causes the switch to exhibit this behavior?
- MAC flooding, where Content Addressable Memory (CAM) table exhaustion forces the switch into a fail-open state that broadcasts unicast frames across all ports.Cevap
- BARP poisoning, where unsolicited gratuitous ARP replies overwrite host ARP caches to redirect gateway traffic directly to the attacker's physical address.
- CVLAN hopping, where outer 802.1Q tags are prepended to frames to bypass switch ingress filters and traverse isolated virtual network boundaries.
- DMAC spoofing, where an attacker duplicates the legitimate hardware address of an authorized server to hijack active network sessions.
Cevap
MAC flooding (CAM table overflow) is occurring, which exhausts switch memory and forces it to enter a fail-open state where unicast frames are flooded across all physical switch ports.
The correct answer identifies MAC flooding (CAM table overflow). Managed switches maintain a Content Addressable Memory (CAM) table to map MAC addresses to physical ports. When an attacker floods a port with thousands of randomized source MAC addresses, the CAM table fills to capacity. To maintain connectivity, switches enter a 'fail-open' mode, broadcasting all incoming unicast traffic out of every port in that VLAN. This permits packet sniffers connected to any port on the switch to intercept traffic not intended for them.
Adım Adım Çözüm
Anahtar Kavram
Switch CAM Table Overflow / MAC Flooding Attack Indicators