MAC Flooding Attack Explained | AP Cybersecurity
MAC Flooding Attacks Explained (and How Switches Fail)
A MAC flooding attack overwhelms a network switch's address table so the switch starts broadcasting traffic to every port, letting an attacker capture data meant for others.
Contents
How MAC flooding works
A switch normally learns which device is on each port and sends traffic only where it belongs, using a table of MAC addresses. In a MAC flooding attack, the adversary sends a flood of fake MAC addresses until that table is full.
When the table overflows, many switches fail open and broadcast incoming traffic to all ports, behaving like a hub. The attacker, connected to the switch, can then sniff traffic intended for other devices.
After an attacker floods a switch with thousands of fake MAC addresses, they begin seeing other users' traffic. Why?
Reveal answer
The switch's address table overflowed and it started broadcasting to all ports. With normal switching defeated, the attacker can sniff traffic meant for others.
MAC flooding targets the switch, not a host. The effect is that the switch broadcasts traffic, enabling sniffing. The defense is port security.
Defending with port security
Port security on a switch limits how many MAC addresses a port will accept, so a flood of fake addresses is rejected instead of overflowing the table. This is a direct, configuration-level control.
Segmentation also limits the blast radius: even if one segment's switch is attacked, the rest of the network is unaffected.
Which switch feature most directly stops a MAC flooding attack?
Reveal answer
Port security, which restricts the number of MAC addresses allowed on a port, so the attacker cannot overflow the address table.
Flooding a switch's memory
MAC flooding tools rapidly fill a switch's address table with bogus entries. Once full, many switches default to broadcasting, turning a switched network into one an attacker can eavesdrop on.
Port security stops the table from overflowing.
Key Terms
| MAC address | A device's hardware network address. |
| Address table | The switch's record of which device is on each port. |
| Fail open | When an overwhelmed switch broadcasts to all ports. |
| Port security | A switch feature limiting MAC addresses per port. |
Match It Up
Common Mistakes
Thinking MAC flooding targets a single host
It targets the switch's address table, affecting many devices.
Confusing it with ARP spoofing
MAC flooding overflows the switch; ARP spoofing forges address mappings.
Missing the 'fail open' behavior
The danger is that the overwhelmed switch broadcasts traffic to all ports.
Forgetting port security
Port security is the direct configuration defense.
Check for Understanding
Frequently Asked Questions
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]