Switches maintain a CAM Table that maps individual MAC addresses on the network to physical ports on the switch. In MAC flooding attack, a switch is fed with many Ethernet frames, each containing diff

A switch uses the CAM table to make forwarding decisions by matching destination MAC addresses to specific ports. When the table is full, the switch cannot store new MAC-to-port mappings and defaults to flooding unknown-destination frames out every port - the same behavior as a hub. This allows an attacker on any port to capture traffic that would normally be unicast to a different segment.

The switch does not crash or enter a Denial of Service state; it continues to forward traffic but loses its ability to make intelligent unicast forwarding decisions, failing open rather than failing closed.

Switches do not rewrite outgoing frame MAC addresses to FF:FF:FF:FF:FF:FF; that address is the Layer 2 broadcast address used in broadcast frames, not a fallback written by the switch hardware.

Switches do not drop all packets and generate SNMP alerts on CAM overflow; dropping traffic would be a fail-closed behavior, which is the opposite of what actually occurs.