Ation of a mack flood is to make uSwitch behave like a hub, as I mentioned before, a hub sends the
packet it receives to all of its port.
However, a switch sends the packet only to the target system so we can make the switch behave like
a hub.
Then it would send the packet to all of its ports and I could listen to the traffic, even though I'm
not the target.
In a massive flooding attack within a very short time, the Switches Mac address table is full with
fake Mac address and port mappings wants to switches, Mac address table is full and it cannot save
any more.
Mac addresses.
It generally enters into a fail open mode and it starts behaving like a network hub.
Ethernet switches uses Mac address tables to determine where to forward traffic on a LAN.
So let's go step by step to understand how the Mac address table is built and used by an Ethernet switch
to help traffic move along the path to its destination.
Now suppose that all of the devices connected to the switch are powered on, but have not seen any traffic
yet.
In this case, the Mac address table of the switch would be empty.
Now, suppose computer AI wants to send traffic to the server.
It prepares an Ethernet frame and it sends it off toward the switch.
The first thing the switch would do when receiving the traffic is to create a new entry in its Mac address
table for computers.
Mac address makes sense.
The switch then performs a lookup on its Mac address table to determine whether it knows which port
to send the traffic to.
And since no matching entries exist in this, which is table.
It floods the frame out all of its interfaces except the receiving port.
Because the frame was sent out to all the switches, other ports, it is received by the target server
as well.
Then the server sends a new frame back toward the switch, the other systems which receive the frame
do nothing.
The switch receives the frame and creates a new entry in its Mac address table for the servers Mac address.
It then performs a lookup of its Mac address table to determine whether it knows which port to send
the service traffic to, and in this case it does.
So it sends the return traffic out only on the port of computer A without flooding.
So this process repeats as devices continue to send traffic to each other, an important detail to remember
is that the Mac address table time out is typically short.
So, for example, the full time out duration of Cisco switches is five minutes.
So an entry is left in the table itself only for that specified amount of time before the timeout expires
and the entry is removed from the table.
Let's look at a switching mechanism with a cybersecurity point of view, the mechanism has two weaknesses
in it.
First, when the Target Mac address is not in the Mac address table, the frames are flooded out of
all the ports.
So unintended systems on the network are capable of sniffing these frames.
The second weakness is that when the Mac address table is full, no new record is accepted.
So what if I fill the table by announcing thousands of fake Mac addresses from a port of the switch?
Most of the switches start to behave like a network hub in such a situation, which means they send
each frame to all of the ports.