In this lesson, we'll discuss MAC flooding.
MAC flooding is a network attack technique
that attempts to compromise the security of a network switch
by attempting to overflow the switches MAC table.
Under normal operations,
a switch uses the media access control address table,
known as a MAC table,
to associate each switch port
with the MAC address of the device
that's connected to that switch port.
This method helps to ensure
that the efficient data forwarding to the correct recipient
is going to be performed by your switch.
Now in a MAC flooding attack,
the attacker attempts to inundate the switch
with fake MAC addresses
until the MAC address table simply fills up.
Once the MAC address table of the switch gets too full,
the switch will enter a fail-safe mode,
and it begins to act like a hub
and starts broadcasting packets
to all the switch ports instead of only sending traffic
to the destination device over a single switch port
because it can't keep up with the demand.
This will in turn compromise the security
and efficiency of your network.
So you may be wondering why would an attacker want to conduct
a MAC flooding attack?
Well, there are three main reasons an attacker
would want to do this:
data snooping, disrupting services,
and bypassing security measures.
First, we have data snooping.
By forcing the switch to broadcast traffic,
an attacker can snoop
or capture sensitive data from the network.
Whenever the switch operates like a hub
when that MAC address table is overflowing,
the attacker can simply place their own network card
into what's known as promiscuous mode
and listen to and capture any network traffic
that's being sent through that switch.
This allows the attacker to breach your confidentiality
because they can now capture
and view the contents of your network traffic
as it's passing through the flooded switch.
Second, we have disruption of services.
By conducting MAC flooding,
an attacker can degrade your network performance
and cause a denial of service attack
by simply overwhelming the network
with all this unnecessary traffic.
Third, we have bypassing of security measures.
Now the use of MAC flooding can also help an attacker
to bypass network security measures
that rely on MAC address filtering.
For example, many wireless
and wired networks are configured
with MAC-based access control.
This security feature restricts network access
by permitting or denying network access to specified devices
based on their media access control address,
which is a unique identifier assigned
to the network interface of that device.
In a network environment,
administrators can set a list of allowed
or denied MAC addresses on a switch
or a wireless access point
and use that to control
which devices can connect to the network.
But if the switch is subjected to MAC flooding,
the switch will simply be unable to process the allow list
or block list associated
with this type of MAC-based access control
and the switch may fail to the open position,
and this allows the devices to connect to the network
even if they were not supposed to be authorized to do so.
So how is MAC flooding actually performed by an attacker?
Well, MAC flooding is actually a simple attack to execute
and requires minimal resources
to cause significant disruptions inside of your network.
Attackers can use specialized tools
that will generate numerous random MAC addresses
and send frames with these fake addresses to the switch.
These frames are sent rapidly
to fill up the switches MAC address table quickly,
and this in turn forces a switch
to enter that fail-safe mode
where it starts broadcasting all the incoming traffic
out of all of its switch ports.
As a network administrator,
you need to understand how to detect
and prevent MAC flooding
from occurring on your networks too.
To secure your networks,
you should implement
an anomaly-based intrusion detection system or an IDS
to help in identifying unusual increases
in MAC address entries
or spikes inside of your broadcast traffic.
You should also set up network monitoring tools
to alert your administrators
about any unusual traffic patterns
or sudden changes in the network's operational metrics.
To prevent MAC flooding from occurring,
you should configure your switches to use port security.
Now, configuring port security on switches
can limit the number of MAC addresses
that are allowed on a single port,
and this effectively will prevent the MAC address table
from becoming overwhelmed too quickly.
Another configuration that you can use
to prevent MAC flooding is to set the limit
on the number of MAC addresses learned
from each switch port.
And this will prevent the switch from becoming overloaded.
And this can also ensure that only legitimate devices
are being connected to your network.
Finally, you need to implement VLANs
to create network traffic segmentations
because this will also help limit the impact
of a MAC flooding attack if one is successful
on a single segment of your network.
Now, it'll only affect a single segment of your network
instead of affecting the entire network
because you've sliced and diced up your network
into these smaller segments by using VLANs.
So remember, MAC flooding is a network attack technique
that attempts to compromise the security of a network switch
by attempting to overflow the switches MAC table.
MAC flooding targets the core functionalities
of a network switch
and aims to compromise the data integrity
and network performance of your systems.
By understanding the nature of this attack,
you can implement robust detection mechanisms
and preventative measures,
such as using port security, anomaly detection,
and vigilant network monitoring,
to better protect your network
against MAC flooding attacks in the future.