MAC Flooding Attacks: Definition, Risks, and Prevention

What is a MAC Flooding Attack?

A MAC flooding attack is a network security threat that exploits the limited storage capacity of a switch’s MAC address table. The attacker sends a high volume of fake or random MAC addresses to the switch and fills the table. Once the table is full, the switch can no longer forward traffic to the correct device. Instead, it starts broadcasting all incoming traffic to every connected port and exposes sensitive data to unauthorized devices.

What is a MAC Address Table?

A MAC address table is a critical component of a network switch that maps MAC addresses (unique hardware identifiers for devices) to their corresponding switch ports. This table allows the switch to forward network traffic directly to the intended device rather than broadcasting it to all ports, making communication efficient and secure.

How MAC Flooding Attacks Work

Attack Process

The attacker sends a flood of Ethernet frames, each with a spoofed MAC address.
These frames are sent to the targeted switch.
The switch tries to store each new MAC address in its table until it reaches capacity.
Once the table is full, the switch stops learning new MAC addresses and starts broadcasting all traffic to every port.

Switch Behavior During and After the Attack

Normal Operation: The switch forwards traffic only to the intended device (unicast mode).
During Attack: The MAC address table is overwhelmed and the switch goes into broadcast mode, sending all traffic to every port.
Result: Attackers can capture sensitive data, like login credentials, financial information and confidential communications.

Risks of MAC Flooding Attacks

Data Exposure – Sensitive information (e.g. financial records, passwords) can be captured by unauthorized users.
Denial of Service (DoS) – Network performance degrades, causing delays, packet loss or complete service disruption.
Network Congestion – Excessive broadcast traffic slows down legitimate communications.
Unauthorized Access – Attackers can capture data meant for other devices, leading to further exploitation (e.g. man-in-the-middle attacks).

How to Detect and Prevent MAC Flooding Attacks

Detection Methods

Network Monitoring Tools (e.g. Wireshark) can detect unusual MAC address changes.
Switch Logs can show MAC address fluctuations, a sign of an attack.

Prevention

Port Security – Limit the number of MAC addresses per port and block unknown devices.
VLAN Segmentation – Segment the network to limit the attack’s reach.
Dynamic ARP Inspection (DAI) – Prevents ARP spoofing, which is often used with MAC flooding.
DHCP Snooping – Blocks rogue DHCP servers from assigning fake IP addresses.
Regular Security Audits – Helps you identify and patch vulnerabilities before attackers do.

Real-World Scenarios

Corporate Networks – Attackers target unpatched switches to steal financial info or trade secrets.
Educational Institutions – Open networks with high user turnover are prone to outages.
Public Wi-Fi – Unsecured networks in cafes or airports are easy to eavesdrop.

Key Terms

MAC Flooding Attack – Filling a switch’s MAC table with fake entries to put it in broadcast mode.
MAC Address Table – A switch’s internal database of MAC addresses to ports.
Port Security – A feature that limits MAC addresses per port to prevent flooding.
Dynamic ARP Inspection (DAI) – A security feature to block ARP spoofing attacks.
Broadcast Mode – When a switch sends traffic to all ports because its MAC table is full.
Man-in-the-Middle (MITM) Attack – Intercepting and altering communication between two devices.
DHCP Snooping – Prevents unauthorized DHCP servers from handing out IP addresses.

By knowing MAC flooding attacks and implementing security, businesses can protect their networks from data breaches and outages.