BTCL; Assistant Manager (Technical) Exam: 2017প্রশ্ন ও সমাধান

MAC flooding is a Layer-2 attack where an attacker connected to a switch bombards it with frames carrying thousands of forged, random source MAC addresses, aiming to exhaust the switch's CAM (Content-Addressable Memory) table — the finite MAC-address-to-port mapping table the switch uses to forward frames only to the correct port.

Why it works: once the CAM table is full, the switch cannot learn any more new MAC addresses. Many switches then "fail open" — for any frame whose destination MAC isn't in the table, they fall back to flooding it out every port, exactly like an unmanaged hub, instead of "failing closed" and dropping it.

How the attacker benefits:

• Because frames are now broadcast to all ports, the attacker's own port also receives traffic that was meant only for the victim(s).
• The attacker runs a packet sniffer (e.g. Wireshark, or the attack tool macof) to passively capture unencrypted credentials, session cookies, or other sensitive data traversing the switch.
• The attacker can follow up with ARP spoofing to keep intercepting traffic even after the CAM table recovers and normal switching resumes.

graph TD
    A[Attacker floods frames with 1000s of fake source MACs] --> B[CAM table fills up]
    B --> C[Switch enters fail-open mode]
    C --> D[Every frame is broadcast to ALL ports]
    D --> E[Attacker sniffs traffic meant for other hosts]

Mitigation: port security (limit learned MACs per port), DHCP snooping, and dynamic ARP inspection on managed switches.

Exam takeaway: MAC flooding degrades a switch into a hub, turning a normally-isolated, switched network into one where sniffing is trivial.