On a recent switch, is mac flooding still a vulnerability to be careful of? If that attack is patched on most of them, then on which type of switch is it still vulnerable?
Yes, this it still is a threat and this is why:
MAC flooding is based on the overflow of the CAM Table (Content Access Memory). The CAM table assigns physical ports to MAC addresses. The CAM table has a limited size and if you manage to exceed that size the switch isn't able anymore to assign new MAC addresses to a physical port. In this situation the switch can do one of three things:
Go to Fail Open mode, which turns the switch into a hub, which means that everyone gets to see everything. One could then sniff the traffic of all connected clients.
Go to Fail Off mode, which causes the switch to keep the existing MAC-Addresses in the CAM-Table but wont add new which will result in new clients being locked out of the network.
The switch uses the CAM table like a ring memory, which means that the addresses that haven't been seen for the longest period get droped. This can be a practical solution for home switches because it's unlikely that you connect some thousand hosts to a DSL router
I also had a situation where a switch crashed complely after I caused an overflow of the CAM-Table. But this was a relativly cheap switch for the home envirnment to be honest.
Though this vulnerablity is kind of system inherent it can't be fixed like other system inherent vulnerabilities. You can prevent it by using port security, which I suggest you to do. If you're the attacker in a pentest you can attack this vulnerablity by using the tool
macoff, which generates loads of ethernet packages with randomly generated MAC addresses to cause an overflow in the CAM table.
I tested it successfully on some Cisco switches, a Netgear switch and some usual desktop switches.