From the course: Certified Ethical Hacker (CEH)

Unlock this course with a free trial

Join today to access over 24,900 courses taught by industry experts.

Performing MAC attacks

Performing MAC attacks

From the course: Certified Ethical Hacker (CEH)

Start my 1-month free trial Buy for my team

Performing MAC attacks

“

- We saw in the previous lesson the way that a switch forwards frames. It learns the source MAC address and it switches based on those learned MAC addresses. It puts that information into a CAM table or content addressable memory table. Those CAM tables, however, usually hardware based tables, meaning it's not storing it in, you know, infinite memory. These CAM tables are of fixed size, so often 64,000 or 128,000 entries. So what happens if that CAM table becomes full and it is filled with bogus information? The only thing the switch can do at that point is to flood the frame. So in this example right here, we have a switch with a full CAM. That full CAM is caused by an attacker. If I use a tool to flood random MAC addresses into port ethernet 1/3, that's going to result in the CAM table filling up with all those source MAC address. Now the CAM table usually has a timer on it and by default, and I'm speaking specifically in the Cisco world here, it's a five minute timer. So, the…

Contents