Switches maintain a CAM Table that maps individual MAC addresses on the network to physical ports on the switch. In MAC flooding attack, a switch is fed with many Ethernet frames, each containing diff

A switch normally uses its CAM table to learn and store MAC address-to-port mappings for efficient unicast forwarding. When a MAC flooding attack overwhelms and fills the CAM table, the switch can no longer store new legitimate MAC-port associations; consequently, it treats unknown unicast frames as broadcast frames and floods them out of all ports, thus behaving like a network hub.

While a MAC flooding attack can degrade network performance and lead to a form of Denial of Service, the switch typically does not crash; instead, its fundamental forwarding mechanism changes to broadcasting.

The switch does not replace outgoing frames with a factory default MAC address; it forwards frames based on their destination MAC address, and if it cannot locate an entry in its CAM table, it broadcasts the frame.

The switch does not necessarily drop every packet during a CAM table overflow; it changes its forwarding behavior to broadcasting. While some switches might have features to alert on unusual activity, sending SNMP alerts to an IDS port is not the default behavior for a filled CAM table.