Exam 312-50v13 Topic 1 Question 243 Discussion
Actual exam question for ECCouncil's 312-50v13 exam
Question #: 243
Topic #: 1
Question #: 243
Topic #: 1
Switches maintain a CAM Table that maps individual MAC addresses on the network to physical ports on the switch. In a MAC flooding attack, a switch is fed with many Ethernet frames, each containing different source MAC addresses, by the attacker. Switches have a limited memory for mapping various MAC addresses to physical ports.
What happens when the CAM table becomes full?
What happens when the CAM table becomes full?
Suggested Answer: A Vote an answer
Comprehensive and Detailed Explanation:
In a MAC flooding attack, tools like macof (shown in the image) rapidly generate a large number of Ethernet frames with spoofed source MAC addresses. These are sent to the switch to overflow its CAM (Content Addressable Memory) table.
Once the CAM table is full:
The switch can no longer learn new MAC-to-port associations.
It fails open and starts broadcasting all incoming traffic to all ports.
This causes the switch to act like a hub.
Consequently, the attacker can:
Sniff traffic that would otherwise be switched.
Intercept data not destined for their system.
From CEH v13 Courseware:
Module 8: Sniffing # Switch-Based Attacks # MAC Flooding
Incorrect Options:
B: A switch typically does not crash but reverts to hub behavior.
C: There is no factory default override behavior like this.
D: Packets are not dropped-this would defeat the attack's purpose.
Reference:CEH v13 Study Guide - Module 8: MAC Flooding and Layer 2 AttacksCisco Security Best Practices - Switch CAM Table Protection
======
In a MAC flooding attack, tools like macof (shown in the image) rapidly generate a large number of Ethernet frames with spoofed source MAC addresses. These are sent to the switch to overflow its CAM (Content Addressable Memory) table.
Once the CAM table is full:
The switch can no longer learn new MAC-to-port associations.
It fails open and starts broadcasting all incoming traffic to all ports.
This causes the switch to act like a hub.
Consequently, the attacker can:
Sniff traffic that would otherwise be switched.
Intercept data not destined for their system.
From CEH v13 Courseware:
Module 8: Sniffing # Switch-Based Attacks # MAC Flooding
Incorrect Options:
B: A switch typically does not crash but reverts to hub behavior.
C: There is no factory default override behavior like this.
D: Packets are not dropped-this would defeat the attack's purpose.
Reference:CEH v13 Study Guide - Module 8: MAC Flooding and Layer 2 AttacksCisco Security Best Practices - Switch CAM Table Protection
======
by Sidney at May 08, 2026, 08:21 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).