MAC ADDRESS FLOODING ATTACK MACOF FOR MAC
MAC ADDRESS FLOODING ATTACK MACOF PC
MAC ADDRESS FLOODING ATTACK MACOF MAC

It allows the switch administrator to specify the maximum number of MAC addresses that can be learned on a port, thus preventing a CAM table overflow attack. In particular: macof has no rate limit mechanism, it sends the packets as fast as the local CPU and the network adapter can support it. However I was not satisfied with this tool.

MAC ADDRESS FLOODING ATTACK MACOF FOR MAC

The traditional tool for MAC table overflow attacks is macof from the dsniff project. Fortunately, Cisco Catalyst switches support a port security command, discussed later in this chapter. macof.py is a MAC address table overflow utility. Keep in mind that the CAM table size can vary by switch model.

As a result, a CAM table overflow attack is by no means a stealth attack, which an attacker might expect to launch without detection. This type of attack noticeably impacts network performance, potentially causing applications to drop packets or even crash.

MAC ADDRESS FLOODING ATTACK MACOF PC

After a short time, the switch learns so many MAC addresses from the attacker's PC that the switch's CAM table overflows, thus forcing the flooding of frames with unlearned MAC addresses. The macof utility can generate as many as 155,000 MAC addresses in a minute. This behavior of flooding frames with an unlearned destination MAC address is called fail-open mode.ДЇigure 6-8 Flooding Behavior After a CAM Table Overflow AttackДЄn attacker could launch a CAM table overflow attack using a utility such as macof, which is a component of a suite of utilities called dsniff. If the attacker had caused the switch's CAM table to overflow before the switch learned the MAC addresses of PC1 and PC2, traffic between these two PCs would be flooded out all other switch ports, other than the ports the traffic was received on, allowing the attacker's PC to see and capture the traffic, as shown in Figure 6-8. The attacker's PC is connected to interface Gig 0/3, and the attacker wants to receive a copy of the traffic flowing between PC1 and PC2. As a result, when frames arrive destined for these unlearned MAC addresses, the switch floods a copy of these frames out all other switch interfaces, other than the interfaces they were received on. Therefore, if the CAM table ever fills to capacity, the switch is unable to learn new MAC addresses. The switch's CAM table, however, does have a finite size. Because the switch knows the MAC addresses of PC1 and PC2 in its CAM table, the traffic flows only between interface Gig 0/1 and Gig 0/2.ДЇigure 6-7 Normal Switch Operation CAM Table for SW1 If the destination MAC address is known to exist off one of the switch ports, the frame is forwarded out only that port.ДЇor example, consider Figure 6-7. Then, when a frame enters the switch, the switch interrogates the frame's destination MAC address. Specifically, the CAM table contains a listing of MAC addresses that have been learned from each switch port. A Cisco Catalyst switch uses a Content Addressable Memory (CAM) table to store the information used by the switch to make forwarding decisions.

Mac address flooding attack macof