Switches maintain a CAM Table that maps individual MAC addresses on the network to physical ports on the switch. In MAC flooding attack, a switch is fed with many Ethernet frames, each containing…

Standard switch behavior upon CAM table exhaustion is to flood frames out all ports because it can no longer make forwarding decisions based on destination MAC-to-port mappings. This fail-open behavior mirrors how an Ethernet hub operates, allowing an attacker connected to any port on the switch to capture all network traffic with a packet sniffer, which is the primary goal of a MAC flooding attack.

The switch does not crash or stop forwarding traffic upon CAM table overflow; it continues to operate in a degraded broadcast mode rather than halting, so a denial of service is not the direct result.

Switches do not overwrite frame destination MAC addresses with FF:FF:FF:FF:FF:FF in response to CAM overflow; that broadcast address is used in legitimate broadcast frames and is not inserted by the switch hardware during overflow.

Switches do not drop all packets or automatically generate SNMP alerts to an IDS port upon CAM table overflow; this is not part of the IEEE 802.1D standard switch forwarding behavior.