‫atIon of a Mac flood is to make a switch behave like a hub.
‫As I mentioned before, a hub sends the packet it receives to all of its ports.
‫However, a switch sends the packet only to the target system so we can make the switch behave like
‫a hub.
‫Then it would send a packet to all of its ports, and I could listen to the traffic even though I'm
‫not the target.
‫In a Mac flooding attack within a very short time, the Switches Mac address table is full with fake
‫Mac address and port mappings.
‫Once the Switches Mac address table is full and it cannot save anymore, Mac addresses, it generally
‫enters into a fail open mode and it starts behaving like a network hub.
‫Ethernet switches uses Mac address tables to determine where to forward traffic on a LAN.
‫So let's go step by step to understand how the Mac address table is built and used by an Ethernet switch
‫to help traffic move along the path to its destination.
‫Now, suppose that all of the devices connected to the Switch are powered on, but have not seen any
‫traffic yet.
‫In this case, the Mac address table of the Switch would be empty.
‫Now, suppose Computer A wants to send traffic to the server.
‫It prepares an Ethernet frame and it sends it off toward the switch.
‫The first thing the Switch would do when receiving the traffic is to create a new entry in its Mac address
‫table for computers.
‫Mac address makes sense.
‫The Switch then performs a lookup on its Mac address table to determine whether it knows which port
‫to send the traffic to.
‫And since no matching entries exist in this Switch's table.
‫It floods the frame out all of its interfaces, except the receiving port.
‫Because the frame was sent out to all this, which is other ports, it is received by the target server
‫as well.
‫Then the server sends a new frame back toward the switch, the other systems which receive the frame
‫do nothing.
‫The switch receives the frame and creates a new entry in its Mac address table for the server's Mac
‫address.
‫It then performs a lookup of its Mac address table to determine whether it knows which port to send
‫the server's traffic to.
‫And in this case, it does, so it sends the return traffic out only on the port of Computer A without
‫flooding.
‫So this process repeats as devices continue to send traffic to each other, an important detail to remember
‫is that the Mac address table timeout is typically short.
‫So, for example, the default timeout duration of Cisco switches is five minutes.
‫So an entry is left in the table itself only for that specified amount of time before the timeout expires.
‫And the entry is removed from the table.
‫Let's look at this switching mechanism with a cyber security point of view.
‫The mechanism has two weaknesses in it.
‫First, when the target Mac address is not in the Mac address table, the frames are flooded out of
‫all the ports.
‫So unintended systems on the network are capable of sniffing these frames.
‫The second weakness is that when the Mac address table is full, no new record is accepted.
‫So what if I fill that table by announcing thousands of fake Mac addresses from a port of the switch?
‫Most of the switches start to behave like a network hub in such a situation, which means they send
‫each frame to all of the ports.