GPEN · Question #219
In which of the following attacks does the attacker overload the CAM table of the switch?
The correct answer is A. Mac flooding. MAC flooding attacks overwhelm a switch's CAM table by sending frames with thousands of spoofed source MAC addresses, forcing the switch into fail-open mode where it broadcasts traffic to all ports.
Question
In which of the following attacks does the attacker overload the CAM table of the switch?
Options
- AMac flooding
- BMan-in-the-middle attack
- CMonkey-in-the-middle attack
- DARP poisoning
How the community answered
(40 responses)- A75% (30)
- B8% (3)
- C5% (2)
- D13% (5)
Why each option
MAC flooding attacks overwhelm a switch's CAM table by sending frames with thousands of spoofed source MAC addresses, forcing the switch into fail-open mode where it broadcasts traffic to all ports.
A MAC flooding attack exhausts the finite memory of the switch's Content Addressable Memory (CAM) table by injecting large volumes of frames each carrying a unique fake source MAC address. Once the CAM table is full, the switch can no longer learn new legitimate MAC-to-port mappings and defaults to broadcasting all frames out every port, effectively turning it into a hub. This allows an attacker on the same segment to capture traffic intended for other hosts.
A man-in-the-middle attack intercepts communication between two parties but does not specifically target or overload the switch CAM table to accomplish this.
'Monkey-in-the-middle' is not a standard recognized network attack category and does not describe the CAM table overload mechanism.
ARP poisoning corrupts ARP caches on hosts to redirect traffic at Layer 3/2 but does not involve flooding the switch CAM table with fake MAC addresses.
Concept tested: MAC flooding and CAM table exhaustion attacks
Source: https://www.cisco.com/c/en/us/support/docs/lan-switching/ethernet/10556-63.html
Topics
Community Discussion
No community discussion yet for this question.