What Is a MAC Address?

A MAC address is a Layer 2 hardware address used for communication on Ethernet networks.

Example:

```

AA:BB:CC:DD:EE:FF 

Switches use MAC addresses to learn which devices are reachable through particular interfaces.

What Is a MAC Address Table?

A switch maintains a table that maps learned MAC addresses to switch interfaces and VLANs.

```

+-------------------------------+
|       MAC Address Table       |
+-------------------------------+
| MAC Address       | Interface |
+-------------------+-----------+
| AA:AA:AA:AA:AA:01 | Gi0/1     |
| BB:BB:BB:BB:BB:02 | Gi0/2     |
| CC:CC:CC:CC:CC:03 | Gi0/3     |
+-------------------+-----------+ 

On Cisco switches, you can view the MAC address table with:

```

show mac address-table 

What Is CAM?

CAM stands for Content Addressable Memory.

Traditionally, the term CAM table is commonly used when discussing the hardware structure used by a switch to make Layer 2 forwarding decisions. In Cisco documentation and discussions, you will often see the terms MAC address table and CAM table used in this context.

How Does a Switch Learn MAC Addresses?

When an Ethernet frame arrives at a switch, the switch can learn the source MAC address from the incoming frame.

```

PC-A
MAC = AA:AA:AA
|
| Frame arrives
v
+----------+
|  Switch  |
+----------+
|
v
Learns:

AA:AA:AA -> Gi0/1 

The switch then uses the destination MAC address to determine where the frame should be forwarded.

Normal Switching Behavior

```

PC-A                 PC-B
MAC AA               MAC BB
|                    |
|                    |
+------ Switch ------+

MAC Table:

AA -> Gi0/1
BB -> Gi0/2

Frame:
AA -> BB

Switch forwards the frame
toward Gi0/2. 

This is much more efficient than sending the frame out of every port in the VLAN.

What Is MAC Flooding?

In a MAC flooding attack, an attacker sends a very large number of frames with many different source MAC addresses.

```

Attacker
|
| MAC 001
| MAC 002
| MAC 003
| MAC 004
| MAC 005
| MAC 006
| ...
v
+----------+
|  Switch  |
| MAC Table|
+----------+ 

The goal is to consume available MAC-table resources.

If the switch can no longer maintain the expected MAC information, its forwarding behavior can change. Depending on the platform and circumstances, unknown unicast frames may be flooded within the relevant VLAN.

Why Can MAC Flooding Be a Security Problem?

Under normal conditions:

```

Destination MAC known

Switch
|
+----> Correct port 

If a destination MAC is unknown:

```

Destination MAC unknown

Switch
|
+----> Flood within the applicable VLAN
(subject to switch behavior) 

An attacker may attempt to exploit this behavior to increase the amount of traffic visible on the attacker's local segment.

However, MAC flooding should not be described as a guaranteed way to capture all switched traffic. Modern switches, network segmentation, security controls, and platform behavior can limit its impact.

MAC Flooding Attack Diagram

                   Switch
             +----------------+
             |                |
             |  MAC Table     |
             |                |
             +----------------+
               /      |      \
              /       |       \
            PC-A     PC-B    PC-C
                        ^
                        |
                     Attacker
                        |
              Many fake source MACs
              -------------------->
    

The attacker attempts to generate enough unique source MAC addresses to put pressure on the switch's forwarding table.

MAC Flooding vs MAC Spoofing

Port Security: An Important Defense

Port Security can restrict the number of MAC addresses allowed on an access interface.

Example:

```

Switch(config)# interface gigabitEthernet 0/10
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2 

This can reduce the ability of an endpoint-facing port to learn an unlimited number of source MAC addresses.

Sticky MAC Addresses

Cisco switches can use sticky MAC learning to dynamically learn MAC addresses and associate them with port security.

```

Switch(config-if)# switchport port-security mac-address sticky 

Sticky MAC addresses can appear in the running configuration. If persistence across a reload is required, the configuration must be saved appropriately.

Port Security Violation Modes

Cisco port security commonly supports violation modes such as:

The exact operational behavior depends on the Cisco platform and configuration.

Other Security Controls

Port Security is only one control. A secure Layer 2 network may also use:

• DHCP Snooping
• Dynamic ARP Inspection
• IP Source Guard
• 802.1X authentication
• Network segmentation
• VLAN security
• Network monitoring
• Access control policies

How to Check the MAC Address Table

```

Switch# show mac address-table 

You can also examine a specific interface:

```

Switch# show mac address-table interface gigabitEthernet 0/10 

These commands help administrators understand which MAC addresses the switch has learned and where they were learned.

How to Check Port Security

```

Switch# show port-security 

For a specific interface:

```

Switch# show port-security interface gigabitEthernet 0/10 

These commands can help identify maximum MAC limits, learned secure addresses, and violation information.

Practical Office Example

```

Office Switch

Gi0/1 -> Router
Gi0/2 -> Employee PC
Gi0/3 -> Employee PC
Gi0/4 -> Printer
Gi0/5 -> Attacker / Unauthorized Device

Apply security controls:

Gi0/2 -> Port Security
Gi0/3 -> Port Security
Gi0/4 -> Port Security

Limit the number of
expected MAC addresses. 

If a normal workstation port is expected to have one endpoint, allowing an unnecessarily large number of MAC addresses can increase the attack surface.

Packet Tracer Lab: MAC Table and Port Security

Build a small switched network:

```

PC1 ----
PC2 ----- Switch ----- Router
PC3 ----/ 

Practice:

1. Connect multiple PCs to the switch.
2. Generate traffic between the PCs.
3. Check the MAC address table.
4. Identify which MAC address was learned on each port.
5. Configure Port Security on an access port.
6. Set a reasonable maximum MAC address count.
7. Enable sticky MAC learning if appropriate.
8. Verify the Port Security status.

```

show mac address-table
show port-security
show port-security interface gigabitEthernet 0/2 

MAC Flooding Prevention Checklist

• Use Port Security on suitable access ports.
• Set reasonable maximum MAC address limits.
• Use sticky MAC where appropriate.
• Choose a suitable violation mode.
• Disable unused switch ports.
• Place unused ports into an unused VLAN where appropriate.
• Use 802.1X where stronger endpoint authentication is required.
• Monitor unusual MAC-learning behavior.
• Use network segmentation to reduce the impact of Layer 2 attacks.

Quick Quiz

1. What is a MAC address table?

2. What does a MAC flooding attack attempt to do?

3. Which Cisco feature can limit the number of MAC addresses learned on an access port?

4. Which command displays the MAC address table?

Key Takeaways

• Switches use MAC address tables for efficient Layer 2 forwarding.
• MAC flooding attempts to overwhelm the switch's MAC-learning resources.
• Unknown unicast traffic may be flooded within the applicable VLAN when the destination is not known.
• MAC flooding is not a guaranteed method of capturing all switched traffic.
• Port Security can limit the number of MAC addresses allowed on access ports.
• Sticky MAC can help associate learned MAC addresses with Port Security.
• 802.1X provides stronger identity-based access control than relying only on MAC addresses.
• Monitoring and Layer 2 security controls should be used together.