MAC Flooding Attack Explained (and How to Prevent It)
A MAC flooding attack overwhelms a switch's MAC address table with thousands of fake source MAC addresses. Once the table is full, the switch can no longer learn where real devices are, so it floods unknown-destination frames out of every port — behaving like a hub. The attacker then sniffs traffic that was never meant for them. The defence is port security.
How a switch normally protects you
To understand the attack, you first need to understand what a switch does right. A switch learns by looking at the source MAC address of every frame that arrives, and recording which port that MAC was seen on in its MAC address table (also called the CAM table).
When a frame arrives destined for a MAC the switch knows, it forwards it out only that one port. Everyone else on the switch never sees it. This is the fundamental difference between a switch and a hub, and it is why switched networks are not trivially sniffable.
The catch: if the destination MAC is not in the table, the switch has no idea where to send it. So it does the only safe thing — it floods the frame out of every port except the one it arrived on, hoping the destination will reply and reveal itself. This behaviour is correct, necessary, and exactly what the attack weaponises.
The attack
The MAC address table is a finite hardware resource. A typical access switch holds somewhere between 8,000 and 32,000 entries. That sounds like plenty — until you realise an attacker can generate fake entries far faster than the table can hold them.
- The attacker connects to any access port.
- They send a flood of frames, each with a different, randomly generated source MAC address — tens of thousands per second is trivial with a tool like
macof. - The switch dutifully learns every one of them, because learning from source MACs is what switches do.
- The table fills. Legitimate MAC entries age out or get evicted and cannot be relearned, because there is no space.
- Now, for most real traffic, the destination MAC is not in the table — so the switch floods it out every port.
- The attacker, sitting on one of those ports, captures traffic between other devices entirely.
The result is called fail-open behaviour: when the switch's forwarding intelligence is exhausted, it degrades to flooding rather than dropping. From a pure availability standpoint that is the right design choice — but from a confidentiality standpoint it is a disaster, and that tension is precisely what makes this attack interesting.
What the attacker gains — and does not gain
It is worth being precise about the impact, because this is often overstated.
| Outcome | |
|---|---|
| Confidentiality | Broken. The attacker sees traffic between other hosts in the same VLAN that they should never have seen. |
| Availability | Degraded. Flooding every frame out every port wastes bandwidth and CPU across the whole switch. |
| Scope | Limited to the attacker's VLAN and switch. Flooding does not cross a VLAN boundary or a router. |
| Encryption | Unaffected. Sniffed HTTPS/SSH traffic is still encrypted. The attacker sees the packets, not the plaintext. |
That last row matters a great deal in practice. MAC flooding was devastating in the era of Telnet, FTP and plain HTTP. Today, with TLS almost everywhere, an attacker who sniffs your traffic mostly gets ciphertext. It still leaks valuable metadata — who talks to whom, when, how much — and any legacy plaintext protocol still on the network is fully exposed. So it remains a real risk, just not the total compromise it once was.
The defence: port security
The fix is direct: limit how many MAC addresses a single access port is allowed to learn. A normal user port needs one, maybe two or three (a PC behind an IP phone). It never needs thousands.
Switch(config)# interface range GigabitEthernet0/1 - 24
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport port-security
Switch(config-if-range)# switchport port-security maximum 2
Switch(config-if-range)# switchport port-security mac-address sticky
Switch(config-if-range)# switchport port-security violation shutdownLine by line:
switchport mode access— port security only works on access ports, not on dynamic ports.switchport port-security— enable the feature.maximum 2— the port may learn at most two MACs. The attacker's third fake MAC triggers a violation instantly, so the flood dies at frame three rather than frame thirty thousand.mac-address sticky— dynamically learn the real MAC and write it into the running config, so you do not have to type it in manually.violation shutdown— on violation, put the port into err-disabled. The other options arerestrict(drop and log) andprotect(drop silently).
Verify it:
Switch# show port-security interface GigabitEthernet0/1
Switch# show port-security addressDefence in depth
Port security is the primary control, but a well-built network has more than one layer:
- 802.1X — authenticate the device or user before the port carries any traffic at all. This is strictly stronger than port security, because it does not rely on MAC addresses, which are easily spoofed.
- Shut down unused ports — an attacker needs a live port. Do not give them one.
- Restrict VLAN scope — flooding is confined to a VLAN. Smaller VLANs mean a smaller blast radius.
- Encrypt everything — assume the wire is hostile. If all traffic is TLS/SSH/IPsec, a successful sniff yields very little.
- Monitor — a sudden explosion in MAC-table size is a loud, easily alerted-on signal. Watch it.
MAC flooding sits alongside VLAN hopping, ARP spoofing and rogue DHCP as one of the four classic Layer 2 attacks. They share a common lesson: Layer 2 was designed for cooperation, not for hostility. Every one of these attacks abuses a protocol behaving exactly as designed. Security at Layer 2 is something you must add on purpose. Practise the defence in our port-security lab.
Frequently asked questions
What is a MAC flooding attack?
An attack that fills a switch's MAC address table with thousands of fake source MAC addresses. Once full, the switch cannot learn real MACs and floods frames out every port like a hub, letting the attacker sniff traffic.
How does MAC flooding let an attacker sniff traffic?
When the MAC table is full, the switch cannot look up the destination port for a frame, so it floods the frame out of every port. The attacker, on one of those ports, receives traffic meant for other devices.
How do I prevent MAC flooding?
Enable port security on access ports with a low maximum MAC count (typically 1-3) and a violation action of shutdown. 802.1X provides an even stronger defence by authenticating devices before the port carries traffic.
Does MAC flooding break encryption?
No. The attacker captures the packets, but HTTPS, SSH and IPsec traffic remains encrypted. It still leaks metadata and fully exposes any legacy plaintext protocol on the network.
Can MAC flooding cross VLANs?
No. Flooding is confined to the attacker's VLAN on that switch. It does not cross a VLAN boundary or a router, which is one reason smaller VLANs limit the blast radius.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.