A switch suddenly floods unicast frames out of every port in a VLAN after one access port sends thousands of frames with random source MAC addresses. Which attack is this, and which control mitigates it?
Select an answer to reveal the explanation.
Short Explanation
Your switch's MAC table is an address book with only so many pages. Fill it with junk and it forgets where everyone lives, so it shouts every message to the whole room, which is perfect for an eavesdropper. Port security caps how many entries a single port can add.
Full Explanation
A switch learns source MAC addresses into its content addressable memory table and forwards unicast frames only to the port where the destination was learned. The table has finite capacity. In a MAC flooding or CAM table overflow attack, a host sends large numbers of frames with random source MACs until the table fills; legitimate entries age out and cannot be relearned, so frames to unknown destinations are flooded out every port in the VLAN, letting the attacker capture traffic like a hub. Port security limits the number of MAC addresses a port may learn and takes a violation action when the limit is exceeded, stopping one port from exhausting the table. ARP poisoning forges IP-to-MAC mappings in host caches to redirect traffic; it does not depend on random source MACs or cause flooding. DHCP starvation uses spoofed MACs to exhaust a DHCP pool; snooping trust on the uplink blocks rogue servers but does not stop starvation, and the symptom described is unicast flooding, not lease failure. Spanning-tree manipulation uses BPDUs to change the topology, mitigated by BPDU or root guard, and has nothing to do with the MAC table. Exam caveat: the flooding symptom is the giveaway that distinguishes CAM overflow from other Layer 2 attacks. Operational check: compare the MAC table count per port against the normal baseline and confirm port security violations are logged for the attacking port.