Contents
What is the recommended mitigation for MAC table overflow attacks?
The mitigation for this attack is to set a limit on the number of devices expected per port. On Cisco devices, this is achieved by enabling Port Security.
Does a device have more than one MAC address?
Devices with multiple interfaces using IEEE protocols will have multiple MAC addresses, one MAC address for each interface. MAC, and other data-link, addresses are only relevant or seen on the LAN to which the MAC address is connected.
How can I limit the number of secure MAC addresses?
If you limit the number of secure MAC addresses to one address and assign a single secure MAC address to that port, the machine attached to that port is assured the full bandwidth of the port, and only that machine with that particular secure MAC address can successfully connect to that switch port.
How can I mitigate MAC address spoofing attack?
The methods used to mitigate MAC address spoofing attack may also prevent DHCP starvation by using the DHCP snooping feature. You can limit the number of MAC addresses on a switch port, a mitigation strategy for CAM table flooding, to mitigate DHCP starvation attack.
What happens if the MAC address does not exist on the switch?
If an entry already exists for the destination MAC address, the switch forwards the frame to the correct port. If the destination MAC address does not exist in the MAC address table, the switch floods the frame out of every port on the switch, except the port where the frame was received.
What is the MAC address table in a switch?
All Catalyst switch models use a MAC address table for Layer 2 switching. The MAC address table in a switch contains the MAC addresses associated with each physical port and the associated VLAN for each port. As a frame arrives on a switch port, the source MAC address is recorded in the MAC address table.