nerdexam
EC-Council

312-50V11 · Question #684

Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP cache of these switches. If these switches' ARP cache is successfully flooded, what will be the result?

The correct answer is A. The switches will drop into hub mode if the ARP cache is successfully flooded. Macof floods a switch's CAM table with spoofed MAC addresses, and once the table is exhausted the switch fails open by broadcasting all frames out every port, effectively behaving like a hub.

Sniffing

Question

Nathan is testing some of his network devices. Nathan is using Macof to try and flood the ARP cache of these switches. If these switches' ARP cache is successfully flooded, what will be the result?

Options

  • AThe switches will drop into hub mode if the ARP cache is successfully flooded.
  • BIf the ARP cache is flooded, the switches will drop into pix mode making it less susceptible to
  • CDepending on the switch manufacturer, the device will either delete every entry in its ARP cache
  • DThe switches will route all traffic to the broadcast address created collisions.

How the community answered

(41 responses)
  • A
    93% (38)
  • B
    2% (1)
  • D
    5% (2)

Why each option

Macof floods a switch's CAM table with spoofed MAC addresses, and once the table is exhausted the switch fails open by broadcasting all frames out every port, effectively behaving like a hub.

AThe switches will drop into hub mode if the ARP cache is successfully flooded.Correct

When Macof generates thousands of frames with random source MAC addresses, it fills the switch's Content Addressable Memory (CAM) table beyond capacity. Once full, the switch cannot store new MAC-to-port mappings and fails open by flooding all incoming unicast frames out all interfaces - a condition commonly called 'hub mode.' This allows an attacker with a packet sniffer on the same segment to capture traffic intended for other hosts.

BIf the ARP cache is flooded, the switches will drop into pix mode making it less susceptible to

'Pix mode' is not a valid switch operating state; Cisco PIX refers to a legacy firewall appliance and has no relevance to switch CAM table overflow behavior.

CDepending on the switch manufacturer, the device will either delete every entry in its ARP cache

Switches do not respond to CAM table overflow by deleting existing entries; they fail open and flood all frames, which is the opposite of a selective deletion response.

DThe switches will route all traffic to the broadcast address created collisions.

Switches do not re-route traffic to a broadcast address as a result of CAM flooding; they forward frames out all physical ports simultaneously, which is unicast flooding rather than broadcast routing.

Concept tested: CAM table MAC flooding attack causing switch fail-open

Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/configuration/guide/sy_swcg/port_security.html

Topics

#MAC flooding#CAM table overflow#hub mode#Macof

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice