Switches maintain a CAM Table that maps individual MAC addresses on the network to physical ports on the switch. In MAC flooding attack, a switch is fed with many Ethernet frames, each containing different source MAC addresses, by the attacker. Switches have a limited memory for mapping various MAC addresses to physical ports. What happens when the CAM table becomes full?

Question

Accepted Answer

A. Switch then acts as hub by broadcasting packets to all machines on the network When a switch's CAM table is full, it can no longer learn new MAC-to-port mappings, so it defaults to flooding all incoming frames out every port except the one it arrived on - the same behavior as a hub. This is called 'fail-open' mode and allows an attacker connected to the same switch to capture traffic intended for other hosts using a packet sniffer.

Answer

B. The CAM overflow table will cause the switch to crash causing Denial of Service A full CAM table does not crash the switch or cause a denial of service; the switch continues forwarding traffic, just inefficiently by broadcasting.

Answer

C. The switch replaces outgoing frame switch factory default MAC address of FF:FF:FF:FF:FF:FF Switches do not replace frame destination addresses with the broadcast MAC FF:FF:FF:FF:FF:FF; that address is only used for legitimate broadcast frames, not as a fallback during table overflow.

Answer

D. Every packet is dropped and the switch sends out SNMP alerts to the IDS port Switches do not drop all packets or automatically generate SNMP alerts to an IDS port when the CAM table is full; packet dropping is not the fail-open behavior of commodity switches.

Switches maintain a CAM Table that maps individual MAC addresses on the network to physical ports on the switch. In MAC flooding attack, a switch is fed with many Ethernet frames, each containing…

Question

Exhibit

Options

How the community answered

Why each option

Topics

Community Discussion