nerdexam
GIAC

GPEN · Question #219

In which of the following attacks does the attacker overload the CAM table of the switch?

The correct answer is A. Mac flooding. MAC flooding attacks overwhelm a switch's CAM table by sending frames with thousands of spoofed source MAC addresses, forcing the switch into fail-open mode where it broadcasts traffic to all ports.

Exploitation & Post-Exploitation Techniques

Question

In which of the following attacks does the attacker overload the CAM table of the switch?

Options

  • AMac flooding
  • BMan-in-the-middle attack
  • CMonkey-in-the-middle attack
  • DARP poisoning

How the community answered

(40 responses)
  • A
    75% (30)
  • B
    8% (3)
  • C
    5% (2)
  • D
    13% (5)

Why each option

MAC flooding attacks overwhelm a switch's CAM table by sending frames with thousands of spoofed source MAC addresses, forcing the switch into fail-open mode where it broadcasts traffic to all ports.

AMac floodingCorrect

A MAC flooding attack exhausts the finite memory of the switch's Content Addressable Memory (CAM) table by injecting large volumes of frames each carrying a unique fake source MAC address. Once the CAM table is full, the switch can no longer learn new legitimate MAC-to-port mappings and defaults to broadcasting all frames out every port, effectively turning it into a hub. This allows an attacker on the same segment to capture traffic intended for other hosts.

BMan-in-the-middle attack

A man-in-the-middle attack intercepts communication between two parties but does not specifically target or overload the switch CAM table to accomplish this.

CMonkey-in-the-middle attack

'Monkey-in-the-middle' is not a standard recognized network attack category and does not describe the CAM table overload mechanism.

DARP poisoning

ARP poisoning corrupts ARP caches on hosts to redirect traffic at Layer 3/2 but does not involve flooding the switch CAM table with fake MAC addresses.

Concept tested: MAC flooding and CAM table exhaustion attacks

Source: https://www.cisco.com/c/en/us/support/docs/lan-switching/ethernet/10556-63.html

Topics

#MAC flooding#CAM table#switch exploitation#network attacks

Community Discussion

No community discussion yet for this question.

Full GPEN Practice