MAC Flooding: Effective Strategies to Combat Network Attacks

What is MAC Flooding?

MAC flooding sends a large number of fake MAC addresses to a network switch. A MAC address is a unique identifier for a Network Interface Card (NIC) of a device that’s connected to the network while a network switch is, simply put, a relay station that forwards data between devices based on MAC addresses.

During normal operation, a device would create a data packet that stores three essential parts:

1. Its own MAC address.
2. Destination MAC address.
3. Data payload (i.e., the actual information that has to be sent).

The data packet in question is then forwarded to the network switch. It will then lookup the MAC address and port table that showcases where to forward the data packet to.

If the MAC address is not known to the network switch, it will enter broadcast mode wherein the data packet is transmitted to all devices in the network. The destination device will respond back to the switch, ensuring proper operation.

To avoid broadcasting all data to all devices at all times, the network switch stores information about the destination device’s MAC address and port in the table. Such an action improves port security and network efficiency.

As with all hardware devices, the MAC table in the network switch can store a finite number of addresses. If too many MAC addresses are stored, the network switch is overloaded and changes to the fail-safe “open” mode.

The safe mode is a backup that’s intended to avoid taking down the entire network whenever the address table is flooded. There’s a tradeoff, however, as the switch enters broadcast mode for all incoming data packets, compromising network performance and port security.

How Do MAC Flooding Attacks Work?

MAC flooding attacks intentionally overwhelm the network switch by sending a large number of packets with different, fake MAC addresses. The table is thus overflown, causing the switch to enter broadcast mode wherein all devices receive all data packets.

While the MAC flood attack could be done purely for network performance degradation, a more common application is to spy on all traffic in the network. If the attacker floods the network switch’s MAC address table while they have a legitimate device connected to the same network, they start receiving all data packets as well.

As such, they may start intercepting and eavesdropping on network traffic and collect valuable information for as long as the MAC address flooding attack lasts.

How Can You Detect MAC Flooding?

Detecting MAC flooding attacks may require specialized software. While there’s a certain network performance degradation that happens, it may be easily assigned to a different reason or may be hard to notice.

Network monitoring software (e.g.,Wireshark) should be employed to analyze traffic and congestion if a MAC flooding attack is suspected. Some software may even send automatic alerts about abnormal network traffic.

Suspicions should arise if there are frequent, unexplained network slowdowns and performance degradation. Another way to check is to connect to the network switch (through SSH or Telnet) and run one of these commands:

Cisco switches:

[show processes cpu history]

HP/Aruba switches:

[enable]

[show system cpu]

Juniper switches:

[show chassis routing-engine]

All of these commands show the CPU utilization and processes. If a MAC flooding attack is happening, CPU utilization will be unusually high.

How to Prevent MAC Flooding Attacks?

There’s many ways to prevent a MAC flooding attack, ranging from monitoring to changing network switch settings. Most of these prevention techniques require some interaction from the user and may change how the network behaves.

First, there’s always the possibility of changing the switch settings. The MAC address table is configurable through software. Users can enable port security features that limit the amount of ports and MAC addresses that can be stored in the MAC address table.

Additionally, the same feature allows users to set one of several actions to be taken when the MAC address table for a specific port is overwhelmed. The network switch may initiate a shutdown, preventing any data packets from being sent, restrict further devices from being added to the MAC address table and generating an alert, and, finally, simply drop any new devices from being added.

Another option that doesn’t directly involve the switch’s MAC address table is to set up virtual LANs on larger networks. A VLAN segments the entire network into smaller chunks, so if any one is affected by a MAC flooding attack, other segments are unaffected.

Finally, there’s the possibility of using the switch to set up MAC address filtering. Doing so can prevent any new MAC address from being added to the table, however, it may be a bit annoying to deal with if new, legitimate devices are being connected to the network frequently.

What is the Difference Between ARP Poisoning and MAC Flooding?

A similar and often mislabeled attack is ARP (Address Resolution Protocol) poisoning. Instead of attempting to overwhelm the switch with a MAC flooding attack, a hacker spoofs his ARP message to associate his MAC address with the IP address of a legitimate device. Usually, the intention is to intercept important traffic.

These two attacks, however, are completely different, even if, on some level, they achieve similar goals. An ARP attack usually affects only a single device on the network while a MAC flooding attack affects the entire network.

Additionally, preventing MAC flooding and preventing ARP poisoning relies on entirely different security measures. So, these two attacks, while having some relation to each through MAC addresses, are extremely different.

What Steps Should You Take if Attacked?

If you suspect a MAC flooding attack is happening, there’s only a few good steps you can take. First, if possible, disconnect all devices in the network to stop the attack from happening. While only some devices may seem to be affected by degradation, the attacker may be collecting packet data, so performance degradation is the least of your concerns.

In any case, you should start reconfiguring the network switch as soon as possible. If you’re taking care of everything during the attack itself, your best bet is to set a low number of MAC addresses for each port. It will inevitably drop some legitimate devices, but it will also surely stop the attack from happening.

If possible, you should then turn to finding out the source of the MAC flooding attack. These attacks don’t happen accidentally, so you know someone is intentionally attacking your network.

All further steps should follow regular good practices of network security. A post-mortem analysis should be conducted with clearly outlined further actionable steps.

Additionally, employees should be trained on the topic to get a better overall understanding within the organization about MAC flooding. Finally, security protocols should be reviewed carefully to prevent further attacks from happening.