Which attack overwhelms a network switch with a large number of MAC addresses?

Which attack overwhelms a network switch with a large number of MAC addresses?

• A. CAM
• B. Administrative controls
• C. DRM
• D. Flooding

Answer: (D)

MAC flooding targets the switch’s ability to learn where devices are. A switch builds a CAM table that maps each MAC address to the port it’s seen on, so it can forward frames only to the right destination. If an attacker floods the switch with a huge number of fake MAC addresses, the CAM table fills up quickly. When the table is full, the switch can no longer learn new addresses, and it must broadcast frames to all ports to reach destinations. That broadcast behavior is the flooding effect, which is exactly what overwhelms the switch in this attack. The CAM reference is just describing the memory that stores the mappings; the dangerous action is the flooding caused by exhausting that table. The other options don’t describe this attack—administrative controls are policy-related, DRM is about digital rights management, and CAM alone refers to the memory rather than the attack method.

MAC flooding targets the switch’s ability to learn where devices are. A switch builds a CAM table that maps each MAC address to the port it’s seen on, so it can forward frames only to the right destination. If an attacker floods the switch with a huge number of fake MAC addresses, the CAM table fills up quickly. When the table is full, the switch can no longer learn new addresses, and it must broadcast frames to all ports to reach destinations. That broadcast behavior is the flooding effect, which is exactly what overwhelms the switch in this attack. The CAM reference is just describing the memory that stores the mappings; the dangerous action is the flooding caused by exhausting that table. The other options don’t describe this attack—administrative controls are policy-related, DRM is about digital rights management, and CAM alone refers to the memory rather than the attack method.