MAC flooding

In computer networking, MAC flooding is a technique employed to compromise the security of network switches.

Switches maintain a MAC Table that maps individual MAC addresses on the network to the physical ports on the switch. This allows the switch to direct data out of the physical port where the recipient is located, as opposed to indiscriminately broadcasting the data out of all ports as a hub does. The advantage of this method is that data is bridged exclusively to the network segment containing the computer that the data is specifically destined for.

In a typical MAC flooding attack, a switch is fed many Ethernet frames, each containing different source MAC addresses, by the attacker. The intention is to consume the limited memory set aside in the switch to store the MAC address table.[1]

The effect of this attack may vary across implementations, however the desired effect (by the attacker) is to force legitimate MAC addresses out of the MAC address table, causing significant quantities of incoming frames to be flooded out on all ports. It is from this flooding behavior that the MAC flooding attack gets its name, and it is this behavior which allows the MAC flooding attack to be used as more than a simple denial-of-service attack[2] against the switching infrastructure.

After launching a successful MAC flooding attack, a malicious user could then use a packet analyzer to capture sensitive data being transmitted between other computers, which would not be accessible were the switch operating normally. The attacker may also follow up with an ARP spoofing attack which will allow them to retain access to privileged data after switches recover from the initial MAC flooding attack.

Counter measures

To prevent MAC flooding attacks, network operators usually rely on the presence of one or more features in their network equipment:

References

  1. "VLAN Security White Paper: Cisco Catalyst 6500 Series Switches". Cisco Systems. 2002. Retrieved 31 January 2015.
  2. Kumar, Sanjeev; Gomez, Orifiel (2010). "Denial of Service Due to Direct and Indirect ARP Storm Attacks in LAN Environment". Journal of Information Security 1 (2): 88–94. doi:10.4236/jis.2010.12010. Retrieved 31 January 2015.
  3. Business Series Smart Gigabit Ethernet Switch User Guide, Linksys, 2007, p. 22
  4. "guide/Mac Auth". Freeradius.org. 2015. Retrieved 31 January 2015.
  5. "Blocking Unknown Unicast Flooding". PacketLife.net. 4 June 2010. Retrieved 31 January 2015.