Study Guide
MAC Flooding and Port Security
How an attacker can exhaust a switch's MAC address table, what that exposes, and how port security, monitoring and other layers limit the damage.
Lesson 4.1 Network & Infrastructure Security
A switch keeps traffic tidy by learning where each device is, and that learning is automatic. This lesson works out how an attacker can abuse it, what they might gain, and how switch port security and other controls limit the damage.
Stage: Think
A notebook with limits
Think it through
A switch believes every source address it sees, and its table holds only so many entries. Using only those two facts, how could someone on the same switch end up receiving copies of other people’s traffic?
- Hint 1: What does a switch do with a frame for a device it does not know?
- Hint 2: What happens to a full notebook when new names keep arriving?
Show what happens
Send frames from a stream of made-up source addresses until the table is full. Real devices that are forgotten cannot be learned again, so frames for them are flooded to every port, including the attacker’s.
Think it through
Show the answer
Answer: B. Those for devices it still holds.
Frames for devices still in the table. Only destinations it has lost, and cannot relearn, are flooded.
Stage: Explain
The mechanism being abused
Ethernet Switching and MAC Addresses explains normal switching in full. Three points from it matter here:
- The switch learns from source addresses. When a frame arrives, the switch records its source MAC address against the port and VLAN it came in on. It does not check whether that address is genuine.
- It forwards using destination addresses. A frame for a learned destination goes out only of that destination’s port.
- Unknown destinations are flooded. A frame for an address the switch has not learned is copied to every other eligible port in the VLAN, so that it still reaches its destination. This is called unknown unicast flooding.
The MAC address table that holds the learned addresses has a limited capacity. MAC flooding attacks that limit.
Stage: Predict
What MAC flooding changes
An attacker sends numerous frames with different fabricated source MAC addresses. If the switch attempts to learn them without effective limits, they can consume available table capacity. This is called MAC flooding or CAM table overflow. (CAM, content-addressable memory, is the kind of memory a switch keeps its table in.)
Think it through
Show the answer
Answer: A. They fade out and cannot return.
Not at once. Entries that are not refreshed age out as usual, and with no free space they cannot be learned again.
A full table does not wipe out what the switch already knows. What it does is stop the switch learning anything new, and entries it already holds are still forgotten in the usual way when they are not refreshed (this is called ageing). So over a few minutes, more and more legitimate devices drop out of the table and cannot get back in. A legitimate destination that is missing from the table is treated as unknown.
Before and after: a deliberately tiny table
To make the effect visible, imagine a switch with only four available entries. This capacity is an educational simplification, not a realistic equipment specification. An attacker is attached to an additional port 4. In this possible sequence, the printer’s entry ages out while fabricated source entries consume the remaining learning capacity.
| Before pressure | Port | One possible full table afterwards | Port |
|---|---|---|---|
Laptop 02:00:00:00:00:10 | 1 | Laptop 02:00:00:00:00:10 | 1 |
Printer 02:00:00:00:00:20 | 2 | Fabricated 02:00:00:00:10:01 | 4 |
Server 02:00:00:00:00:30 | 3 | Server 02:00:00:00:00:30 | 3 |
| Available slot | — | Fabricated 02:00:00:00:10:02 | 4 |
Think it through
Show the answer
Answer: C. To ports 2, 3 and 4.
To ports 2, 3 and 4. The printer’s entry has gone, so the frame is flooded, and the attacker on port 4 receives a copy.
Now suppose a laptop frame arrives for the printer, whose address cannot be relearned while capacity is exhausted. The switch may flood it to ports 2, 3 and 4, subject to VLAN membership and forwarding controls. The attacker may receive a copy. A frame for the still-known server can continue to be forwarded selectively to port 3.
This diagram shows the same difference between a known and an unknown destination on a three-port switch. The four-entry table adds the attacker’s fourth port, to show who the extra recipient is.
A simplified switch with A on port 1, B on port 2 and C on port 3, all in the same VLAN.
- Normal · B is knownA → Switch → Port 2 (B)
MAC table: B → port 2. This unicast frame is forwarded only towards B.
- Table exhaustion · B cannot be learnedMany fabricated source MACs → Full table
An attacker consumes learning capacity. Behaviour depends on the switch and its configured protections.
- B is unknown · flood eligible portsA → Switch → Ports 2 (B) + 3 (C)
Unknown unicast is flooded within the affected VLAN, excluding the ingress port. Known destinations may still be forwarded normally.
A switch does not become a hub. Unknown unicast flooding can also occur during normal operation. Port security limits and monitoring help defend against abusive MAC learning.
Using the four-entry switch from the table, after the fabricated entries have filled the table:
- The laptop sends a frame to the printer. Its destination MAC is
02:00:00:00:00:20. - The switch looks up the destination. The printer’s entry has aged out and there is no free slot to relearn it, so the destination is unknown.
- The switch floods the frame. It copies it to ports 2, 3 and 4: every other eligible port in the VLAN.
- The printer still receives it, so the laptop notices nothing unusual.
- The attacker on port 4 also receives a copy. They can read whatever the frame does not protect.
- A frame for the server is unaffected. The server’s entry is still in the table, so that frame goes only to port 3.
Stage: Explain
Why the hub analogy has limits
An Ethernet hub repeats incoming signals to its other ports without making selective MAC-based forwarding decisions. Flooding can look superficially similar because additional ports receive traffic.
Check your understanding
Show the answer
Answer: C. No: it goes to port 3 only.
No. The server is still known, so its frame goes to port 3 only.
A switch does not literally become a hub. Known destinations may still be forwarded normally. Flooding is constrained by the VLAN, eligible forwarding ports and configured controls. Exact behaviour during table exhaustion depends on the device; some equipment may handle capacity pressure differently. Neither the four-entry table nor the hub analogy predicts every switch’s implementation.
Stage: Predict
Cybersecurity implications
Think it through
An attacker now receives copies of other people’s frames, and the switch is struggling under a flood of frames. Which parts of the CIA triad are at risk?
- Hint 1: Which of the three is about who can see data? Which is about whether a service works?
Show what happens
Confidentiality, because traffic reaches someone it was not meant for, and availability, because the flood can slow or disrupt the network.
Confidentiality: an attacker may receive traffic they would not normally receive. That does not automatically make encrypted application data readable. HTTPS can protect its contents while leaving some metadata visible.
Availability: abusive frame volumes and resource exhaustion may impair performance or disrupt communication. Encryption does not prevent the Layer 2 resource attack itself.
Check your understanding
Show the answer
Answer: B. Metadata, but not the content.
Addresses, timing and size, but not the content, which TLS encrypts.
These are CIA consequences of networking behaviour. This attack differs from ARP poisoning: MAC flooding targets switch learning capacity; ARP poisoning targets IPv4-to-MAC mappings used by hosts.
Stage: Predict
Practical defensive controls
A managed switch is one that an administrator can sign in to and configure; the simple switches sold for homes cannot be configured at all. On managed switches that support it, port security can restrict the number of source MAC addresses learned through an access port. Violation handling may drop offending traffic or disable the port, depending on the platform and configuration. These features need an intentional policy rather than an assumption that every port should allow exactly one address.
Think it through
Show the answer
Answer: C. Only if one device is expected.
Only where one device is really expected. A limit should allow for the devices that legitimately use each port.
For example, an approved phone and computer may legitimately share an access port. A limit should allow for the devices that are really expected on each port.
Monitor unexpected MAC-learning rates, table occupancy and port-security violations. Where supported, unknown-unicast restrictions can limit exposure, but must be evaluated against legitimate traffic to previously unknown destinations. VLAN segmentation limits the flooding domain; it does not stop abusive learning inside that domain by itself. Combine suitable switch controls with encrypted application protocols and monitoring as Defence in Depth.
Stage: Predict
How port security works
Port security restricts the number of MAC addresses learned on an access port and defines an action when that limit is exceeded. The detail below is typical of managed switches:
- A maximum per port. An administrator sets how many different source MAC addresses a port may use. The addresses the port accepts are called secure addresses.
- How secure addresses are chosen. They can be configured by hand, learned automatically from the first frames up to the limit, or learned and then kept in the configuration so that they survive a restart. Platforms name and combine these options differently.
- A violation action. A frame from a new source address when the limit has already been reached is a violation. The switch then applies the configured action.
Think it through
Port 5 allows two secure addresses. Five frames arrive: the staff computer, the phone, the computer again, then two from made-up addresses. Predict which are accepted.
- Hint 1: How many places does the port have?
- Hint 2: Is the computer’s second frame a new address?
Show what happens
The first three: the computer and the phone fill the two places, and the computer’s second frame is already known. The two made-up addresses are violations. The diagram follows the same frames.
A fictional managed switch. Frames arrive in the order shown. The switch learns source addresses until the limit is reached; any further new source address is a violation.
- Staff PC
02:00:00:00:00:50Learned · 1 of 2 - IP phone
02:00:00:00:00:51Learned · 2 of 2 - Staff PC
02:00:00:00:00:50Already secure · forwarded normally - Fabricated source
02:00:00:00:10:01Violation · limit of 2 already reached - Fabricated source
02:00:00:00:10:02Violation · limit of 2 already reached
2 secure addresses, 2 violating frames.
Drop only
Frames from the violating addresses are discarded. The PC and phone keep working. Nobody is told, so the attempt can go unnoticed.
Drop and record
The same frames are discarded, and the switch also counts the violation and can log or raise an alert. The PC and phone keep working.
Disable the port
The whole port stops forwarding, so the PC and phone lose their connection too, until an administrator investigates and re-enables it.
Action names vary by vendor. Cisco IOS, for example, calls these protect, restrict and shutdown.
Against MAC flooding the effect is direct: however many fabricated addresses arrive, this port can add at most two entries to the switch’s shared MAC address table. Limiting source-MAC learning in this way protects the table against exhaustion through this port. It does not guarantee that the whole table has spare capacity: other ports without limits, the table’s overall size, ageing settings and the switch’s own behaviour still matter.
Stage: Predict
Choosing a violation action
Think it through
When a port sees one address too many, should the switch disable the whole port? What might go wrong?
- Hint 1: Who else is plugged into that port?
Show what happens
It stops the attack from that port, but it also cuts off the legitimate devices there, and anyone who can trigger a violation can use it to disrupt a port.
Each action trades security against availability:
| Action | Strength | Weakness |
|---|---|---|
| Drop only | Legitimate devices on the port keep working. | Nobody learns that an attempt was made. |
| Drop and record | Legitimate devices keep working, and the violation can be investigated. | Someone must actually review the records or alerts. |
| Disable the port | Stops everything from that port until a person has looked. | Also cuts off legitimate devices. Someone who can trigger violations can use it to disrupt a port, and a harmless equipment change can cause an outage. |
Stage: Predict
What port security does not do
Think it through
Show the answer
Answer: B. Probably not: the address is allowed.
Probably not. Port security checks the source address, and the laptop is now using an allowed one.
- It checks addresses, not identities. A device can use the MAC address of an allowed device. If someone unplugs a secure printer and gives their laptop the printer’s address, the port may accept it. This is MAC spoofing.
- It only works where it is configured. It is a feature of supported managed switches, applied port by port. An unmanaged switch, or a port left without it, has no limit.
- It does not stop other Layer 2 attacks. ARP poisoning can use the attacker’s own genuine MAC address, so an address limit does not detect it.
- It does not protect data. It limits which addresses can use a port. Encryption such as HTTPS is still what protects the content of traffic that is intercepted.
Because port security trusts addresses that can be copied, higher-security networks may also use port-based network access control, such as 802.1X (a standard from the Institute of Electrical and Electronics Engineers, the IEEE), which makes a device prove who it is before the switch port will carry its traffic. It is beyond this lesson, and worth recognising by name.
Stage: Predict
Detecting MAC flooding
Monitoring abnormal MAC address learning also helps. Signs worth watching include:
- a sudden jump in the number of learned addresses, especially on one access port;
- the MAC address table reaching its capacity;
- port-security violations and ports that have been disabled;
- an unexplained rise in flooded traffic, or complaints of a slow network.
Think it through
One access port suddenly shows forty learned addresses. Before calling it an attack, what innocent explanation could there be?
- Hint 1: What legitimate equipment could bring many addresses to one port?
Show what happens
Another switch, or a computer running many virtual machines, may have been plugged in there.
None of these proves an attack on its own. A newly connected switch or a virtualisation host can legitimately bring many addresses to one port. The evidence needs investigating in context.
On a managed network, the MAC address table and the port-security status of each access port answer two practical questions: which devices are connected where, and has any port seen more addresses than expected? Setting limits that match what each port should really have, and deciding who reviews violations, turns the feature into a working control.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Show the answer
Answer: A. Drop and record.
Drop and record: the legitimate monitors keep working and the violation can be investigated, provided someone reviews the records.
Apply it
Show the answer
Answer: C. It limits how far flooding spreads.
A VLAN limits how far the flooding spreads, but it does not stop abusive learning inside that VLAN.
Apply it
Show the answer
Answer: A. Many new addresses and violations.
A surge of learned addresses on one port together with port-security violations. Even then, investigate in context before concluding.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: It may be flooded to eligible ports in the VLAN, excluding the incoming port.
Unknown unicast can be flooded within the VLAN, excluding ingress. The frame remains unicast; the switch does not literally become a hub and may still forward known destinations normally. This does not route the frame across all networks.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: Limit learned MAC addresses on an access port and define a violation action.; Monitor abnormal MAC learning.
Switch port security can limit learned MACs and define violation actions; monitoring can reveal abnormal learning. NAT addresses a different function, and unlimited learning does not constrain this abuse. These controls do not imply that every switch behaves identically.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: Drop the offending traffic and record the violation for the team to review.
Port security restricts the number of MAC addresses learned on an access port and defines an action when the limit is exceeded. Comparing the actions: dropping and recording keeps legitimate devices working and lets the violation be investigated, provided someone reviews the records. Disabling the port would also cut off the phone and PC; dropping silently means nobody learns of the attempt; and a limit of 50 no longer reflects what each port should really have.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record) · MAC Flooding and Port Security (Supplementary Study Guide explanation)
Show answer
Answer: A device can copy the MAC address of an allowed device, and the port may accept it.; It does not stop ARP poisoning that uses the attacker’s own genuine MAC address.
Port security is a feature of supported managed switches that limits learned addresses per access port. It has limits: it checks addresses, not identities, so a copied MAC address can be accepted, and it does not detect ARP poisoning that uses the attacker’s genuine address. It does not protect the content of traffic, which is what encryption such as HTTPS does. A per-port limit caps what that port adds to the shared table, but other ports, the table’s size and ageing still matter, and it applies only where it is configured.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record) · MAC Flooding and Port Security (Supplementary Study Guide explanation)
Show answer
Answer: Investigate in context: it could be abusive learning, or legitimate kit such as a new switch.
Monitoring abnormal MAC address learning helps defend against MAC flooding. Such signs need investigating in context: a sudden jump on one port fits abusive learning, but a newly connected switch or a virtualisation host can legitimately bring many addresses to one port. None of the signs proves an attack on its own, and an unusual jump should not simply be ignored or silenced.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record) · MAC Flooding and Port Security (Supplementary Study Guide explanation)
Study and revision
Practise the MAC flooding and port-security questions and flashcards through the Networking & Protocols topic. The violation-action, limitation and alert questions draw on this lesson’s supplementary explanation as well as the switching material it builds on. They are learning-only, with no verified exam alignment.
Stage: Consolidate
What to remember
- MAC flooding fills the switch’s table with fabricated source addresses, so legitimate devices that age out cannot be relearned.
- Frames for unknown destinations are then flooded, and the attacker may receive copies; known destinations are still forwarded normally.
- The risks are to confidentiality and availability; encryption protects content, but not against the flood itself.
- Port security limits the addresses learned per port and applies a violation action, each trading security against availability.
- Port security checks addresses, not identities; monitoring and other layers are still needed.
Key terms
- MAC flooding
Sending frames with many different source MAC addresses to exhaust a switch’s MAC address table. This increases flooding of unknown unicast traffic within the VLAN.
- Unknown unicast flooding
A switch copying a frame to every other eligible port in its VLAN because it has not learned which port leads to the frame’s destination MAC address.
- Port security
A switch feature that limits the number of MAC addresses learned on an access port, with a defined action when the limit is exceeded.
Common misunderstandings
The switch floods frames for destinations it cannot learn. Frames for destinations still in its table can be forwarded normally.
The limit is chosen by the administrator. A phone with a computer connected through it, for example, may legitimately need two addresses.
It checks the source address, not the device’s identity. A device using an allowed device’s address may be accepted.
A VLAN limits how far the flooding spreads. It does not stop abusive learning inside that VLAN.
Lesson sources and acknowledgements
Sources and scope
- Taught in Session 5 (see the Session 5 Learning Log): MAC flooding, also called CAM table overflow; fabricated source addresses exhausting the table; unknown unicast flooding within the VLAN; the limits of the hub analogy; the confidentiality and availability consequences; port security limiting learned addresses with a defined violation action; and monitoring abnormal MAC learning.
- Moved from an earlier lesson: “What MAC flooding changes”, “Before and after: a deliberately tiny table”, “Why the hub analogy has limits”, “Cybersecurity implications” and “Practical defensive controls” were previously part of Ethernet Switching and MAC Addresses and keep their wording and anchors here. They develop the additional educational explanations from my Session 5 ChatGPT note-taking discussion.
- Supplementary explanation: the recap of switching, the frame walkthrough, how secure addresses are chosen, the port-security diagram, the violation actions and their trade-offs, the limits of port security, the note on 802.1X, the detection signs, the practical note and the misunderstandings. Vendor action names are given only as an example.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the opening questions about a notebook with limits, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. The switches, ports and addresses are fictional. I have not configured port security or carried out a MAC flooding attack.
A switch port for an ordinary device such as a computer or printer. It belongs to one VLAN, and the frames on it carry no VLAN tag.
A protocol that finds the MAC address for an IPv4 address on the local network, using a broadcast request and a normally unicast reply.
The security objective of keeping systems, services and information accessible to authorised users when required.
The security objective of restricting information to authorised people, systems or processes.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
Transforming data with a cipher and a key so that it cannot be read without the right key. Decryption reverses it.
The standard way devices on a wired local network send data to each other, in units called frames that carry the MAC address of the sender and of the intended receiver.
How far a system, service or piece of information can be seen or reached by others, especially from the internet.
The unit of data at the Data Link layer, such as an Ethernet frame. It is addressed with MAC addresses for delivery across one local link.
An endpoint that sends or receives data on a network. Hosts are nodes, but not every node is an end host.
A link-layer address used for local frame delivery, conventionally 48 bits written in hexadecimal. It may be randomised or spoofed, so it is not proof of identity.
The table in which a switch records which MAC addresses it has learned on which ports, so that it can forward frames selectively.
Sending frames with many different source MAC addresses to exhaust a switch’s MAC address table. This increases flooding of unknown unicast traffic within the VLAN.
Making a network interface use a MAC address other than its own, such as the address of another device.
A document that sets organisational rules and expectations, defining what is and is not permitted.
A switch feature that limits the number of MAC addresses learned on an access port, with a defined action when the limit is exceeded.
An agreed set of rules for how data is formatted, transmitted and interpreted so that devices can communicate.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
Dividing an environment into parts, with enforced rules about which communication is allowed between them.
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
A protocol that protects data in transit with encryption for confidentiality and with integrity protection, and authenticates the server when certificate validation succeeds. HTTPS uses it to secure web traffic.
A switch copying a frame to every other eligible port in its VLAN because it has not learned which port leads to the frame’s destination MAC address.
A software-defined computer with virtual hardware and its own guest operating system, running on resources supplied by a physical host.
A separate network created inside a switch, or a group of linked switches, by assigning each port to a numbered group. Devices in the same VLAN reach each other directly; devices in different VLANs can communicate only through a router.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.