nerdexam
EC-Council

312-50V10 · Question #684

Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP cache of these switches. If these switches' ARP cache is successfully flooded, what will be the result?

The correct answer is A. The switches will drop into hub mode if the ARP cache is successfully flooded.. MAC flooding with a tool like Macof overwhelms a switch's CAM (MAC address) table, causing the switch to fail open and behave like a hub, forwarding all frames out every port.

Sniffing

Question

Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP cache of these switches. If these switches' ARP cache is successfully flooded, what will be the result?

Options

  • AThe switches will drop into hub mode if the ARP cache is successfully flooded.
  • BIf the ARP cache is flooded, the switches will drop into pix mode making it less susceptible to
  • CDepending on the switch manufacturer, the device will either delete every entry in its ARP cache
  • DThe switches will route all traffic to the broadcast address created collisions.

How the community answered

(42 responses)
  • A
    71% (30)
  • B
    14% (6)
  • C
    10% (4)
  • D
    5% (2)

Why each option

MAC flooding with a tool like Macof overwhelms a switch's CAM (MAC address) table, causing the switch to fail open and behave like a hub, forwarding all frames out every port.

AThe switches will drop into hub mode if the ARP cache is successfully flooded.Correct

When a switch's CAM table is completely filled with spoofed MAC addresses, it can no longer make forwarding decisions based on known MAC-to-port mappings. As a result, the switch enters a fail-open state and floods all incoming frames to every port, effectively behaving like a network hub. This allows an attacker on the same segment to capture traffic intended for other hosts.

BIf the ARP cache is flooded, the switches will drop into pix mode making it less susceptible to

'Pix mode' is not a valid or recognized operational state for network switches and does not exist in standard switch behavior.

CDepending on the switch manufacturer, the device will either delete every entry in its ARP cache

Deleting ARP cache entries describes behavior related to ARP cache exhaustion, not MAC table flooding, and is not the fail-open response switches exhibit.

DThe switches will route all traffic to the broadcast address created collisions.

Switches do not route all traffic to a broadcast address as a result of CAM table overflow; they forward unicast frames out all ports, which is functionally different from broadcasting.

Concept tested: MAC flooding attack and switch fail-open behavior

Source: https://www.cisco.com/c/en/us/support/docs/lan-switching/ethernet/10556-41.html

Topics

#MAC flooding#CAM table#switch behavior#Macof

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice