MAC Flooding and Port Security

Lesson plan

Level

Beginner

Time

About 65 minutes; the steps below add up to 63

Learners use two facts from the switching lesson (a switch believes every source address; its table is limited) to work out the attack themselves, and which frames would still be delivered normally. Predictions then precede what a full table forgets, where a frame for the printer goes, the CIA consequences, a one-address limit, the five frames at port 5, disabling a port and a copied address; checks follow the hub comparison and an encrypted copy. The habit to build: every control has a cost, and every sign has an innocent explanation to rule out.

Objectives

• Explain how MAC flooding abuses switch learning and table capacity
• Predict which frames are flooded when the table is exhausted
• Describe the confidentiality and availability consequences
• Explain how port security limits learned addresses, and the trade-offs of each violation action
• Recognise what port security does not do, and the signs of MAC flooding

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Ethernet switching and VLAN lessons first.
• Keep this conceptual: no attack tools or commands are shown or needed.
• The lesson takes about 63 minutes. To teach it in two parts, stop after “How port security works”; the second part opens with “Choosing a violation action”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain how MAC flooding abuses switch learning and table capacity
   • Predict which frames are flooded when the table is exhausted
   • Describe the confidentiality and availability consequences
   • Explain how port security limits learned addresses, and the trade-offs of each violation action
   • Recognise what port security does not do, and the signs of MAC flooding

   Purpose: Learners use two facts from the switching lesson (a switch believes every source address; its table is limited) to work out the attack themselves, and which frames would still be delivered normally. Predictions then precede what a full table forgets, where a frame for the printer goes, the CIA consequences, a one-address limit, the five frames at port 5, disabling a port and a copied address; checks follow the hub comparison and an encrypted copy. The habit to build: every control has a cost, and every sign has an innocent explanation to rule out.

2. 1. A notebook with limits Think 5 min

   Purpose: Let learners derive the attack from two facts they already know.

   Ask

   • How could someone receive other people’s traffic?
   • Which frames would still be delivered normally?

   Responses to expect

   • Filling the table comes with one hint; the second question checks they have not concluded “everything floods”.
   • On screen in turns: the opening question, its answer; then the question on which frames still reach the right port, and its answer.

   Discussion pause: Let pairs discuss before revealing.

   In the lesson window

   • Think it through: A switch believes every source address it sees, and its table holds only so many entries. Using only those two facts, how could someone on the same switch end up receiving copies of other people’s traffic?
   • Think it through: If the table is full, which frames would the switch still send only to the right port?

3. 2. The mechanism being abused Explain 3 min

   Purpose: Recap learning, forwarding and flooding, and the table’s limited size.

   Ask

   • Which address does the switch learn from?

   Responses to expect

   • The source.
   • On screen in turns: the opening; then three points from normal switching, starting with learning; forwarding by destination; flooding unknown destinations; the table’s limited capacity.

4. 3. What MAC flooding changes Predict 9 min

   Purpose: Explain table exhaustion with the four-entry example and the frame walkthrough.

   Ask

   • Does a full table forget everything?
   • Where does the frame for the printer go?

   Responses to expect

   • Many expect the whole table to be wiped.
   • On screen in turns: the opening; then the question on whether a full table forgets, and its answer; a full table stops new learning; a deliberately tiny table, before the attack; the table once it is full; the question on the frame for the printer, and its answer; the printer’s frame is flooded; known and unknown destinations, drawn; following one frame during exhaustion, starting with the laptop; the lookup; the flood; the printer; the attacker; the frame for the server.

   Misconceptions to challenge

   • A learner may believe: “A full table is wiped clean.” Respond: Entries age out gradually and cannot be relearned.

   Discussion pause: The full table is held back: ask which entries will survive the flood before revealing it, then reveal the frame’s journey one stage at a time.

   In the lesson window

   • Think it through: The table is full. Does the switch forget the devices it already knows?
   • Think it through: Look at the full table. The laptop now sends a frame to the printer. Where will it go?

5. 4. Why the hub analogy has limits Explain 3 min

   Purpose: Show where the hub comparison fails.

   Ask

   • Is the server’s frame flooded?

   Responses to expect

   • No: it is still known.
   • On screen in turns: the opening; then the check question on the server’s frame, and its answer; a switch does not become a hub.

   Misconceptions to challenge

   • A learner may believe: “MAC flooding turns a switch into a hub.” Respond: Frames for known destinations still go to one port.

   In the lesson window

   • Check your understanding: During the attack, a frame for the server arrives. The server is still in the table. Is it flooded?

6. 5. Cybersecurity implications Predict 5 min

   Purpose: Name the confidentiality and availability consequences, and separate this attack from ARP poisoning.

   Ask

   • Which parts of the triad are at risk?
   • What can the attacker read of an HTTPS copy?

   Responses to expect

   • Integrity is a common extra guess; ask what the attacker changes.
   • On screen in turns: the opening question, its answer; then the risk to confidentiality; the risk to availability; the check question on an encrypted copy, and its answer; how ARP poisoning differs.

   In the lesson window

   • Think it through: An attacker now receives copies of other people’s frames, and the switch is struggling under a flood of frames. Which parts of the CIA triad are at risk?
   • Check your understanding: The attacker receives a copy of a frame carrying an HTTPS connection. What can they read?

7. 6. Practical defensive controls Predict 4 min

   Purpose: Introduce managed switches, port security and monitoring as layers.

   Ask

   • Should every port allow one address?

   Responses to expect

   • Some say yes; the phone-and-computer case answers it.
   • On screen in turns: the opening; then the question on one address per port, and its answer; a phone and a computer sharing a port; monitoring, and limits on unknown destinations.

   Misconceptions to challenge

   • A learner may believe: “Port security means one device per port.” Respond: The administrator chooses the limit to fit the port.

   In the lesson window

   • Think it through: Should every access port be limited to exactly one MAC address?

8. 7. How port security works Predict 8 min

   Purpose: Explain maximums, secure addresses and violations with the port-5 diagram.

   Ask

   • Which of the five frames are accepted?

   Responses to expect

   • Learners often count the computer’s second frame as a third address.
   • Diagram: the frames at port 5 appear one at a time; before each, ask whether it will be learned, already known or a violation.
   • On screen in turns: the opening; then three parts of port security, starting with the maximum; how secure addresses are chosen; the violation action; the question on five frames, and its answer; port 5, frame by frame, starting with the staff computer; the phone; the computer again; the first made-up address; the second made-up address, and the totals; the three violation actions; the effect against MAC flooding.

   If the explanation does not land: Give two learners “secure address” cards; others arrive one at a time and must show a matching card.

   In the lesson window

   • Think it through: Port 5 allows two secure addresses. Five frames arrive: the staff computer, the phone, the computer again, then two from made-up addresses. Predict which are accepted.

9. 8. Choosing a violation action Predict 5 min

   Purpose: Weigh the three violation actions against security and availability.

   Ask

   • What goes wrong if the port is disabled?

   Responses to expect

   • The attacker can use it to disrupt legitimate users.
   • On screen in turns: the opening question, its answer; then three violation actions compared, starting with drop only; drop and record; disable the port.

   To go further

   • Who should receive the records under “drop and record”, and how quickly should they look?

   In the lesson window

   • Think it through: When a port sees one address too many, should the switch disable the whole port? What might go wrong?

10. 9. What port security does not do Predict 5 min

    Purpose: Set out the limits: copied addresses, unconfigured ports, other attacks, data protection.

    Ask

    • Will port security stop a copied printer address?

    Responses to expect

    • Many assume it recognises devices.
    • On screen in turns: the opening question, its answer; then four limits, starting with addresses, not identities; only where configured; other Layer 2 attacks; protecting data; authenticating devices instead of counting them.

    Misconceptions to challenge

    • A learner may believe: “Port security stops anyone using a stolen address.” Respond: It trusts whatever allowed address arrives, whichever device sends it.

    In the lesson window

    • Think it through: Someone unplugs a secure printer and gives their laptop the printer’s MAC address. Will port security stop them?

11. 10. Detecting MAC flooding Predict 3 min

    Purpose: List the signs, and the need to investigate in context.

    Ask

    • What innocent explanation could there be?

    Responses to expect

    • A new switch or a virtualisation host.
    • On screen in turns: the opening; then the question on innocent explanations, and its answer; no sign proves an attack on its own; two questions a managed switch answers.

    In the lesson window

    • Think it through: One access port suddenly shows forty learned addresses. Before calling it an attack, what innocent explanation could there be?

12. 11. Apply it in a new situation Apply 5 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The ward tests action trade-offs; the VLAN claim tests scope; the signs test detection.
    • On screen in turns: the opening; then the question on the ward’s monitors, and its answer; the question on the guest VLAN, and its answer; the question on which signs to trust, and its answer.

    In the lesson window

    • Apply it: A hospital ward’s access ports serve bedside monitors that must never lose their connection. Which violation action fits best?
    • Apply it: A colleague says the guest VLAN makes MAC flooding impossible. What is the best reply?
    • Apply it: Which pair of signs together most suggests MAC flooding through one port?

13. 12. Check your understanding Check 5 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The violation-action question links to that step’s table.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

14. 13. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: two things port security cannot do.

    Responses to expect

    • Tell a copied address from a real device; protect the content of traffic.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

15. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Fill the table, and lost devices cannot come back.
    • Unknown destinations flood; known ones do not.
    • Confidentiality and availability are at risk.
    • Port security limits addresses per port, with a chosen action.
    • Addresses are checked; the devices behind them are not.

Consolidation

• Fill the table, and lost devices cannot come back.
• Unknown destinations flood; known ones do not.
• Confidentiality and availability are at risk.
• Port security limits addresses per port, with a chosen action.
• Addresses are checked; the devices behind them are not.